Fastjson RCE CVE-2026-16723: A Critical Spring Boot Vulnerability
For years, Fastjson version 1.2.83 stood as the definitive bastion of security for the library’s legacy branch, yet a newly unearthed vulnerability has shattered this illusion. The critical flaw, designated CVE-2026-16723 (CVSS 9.0), empowers adversaries to execute arbitrary remote code within vulnerable Spring Boot applications. Alarmingly, this exploit functions even when the AutoType feature is disabled and does not necessitate the pre-existence of a malicious class within the system.
Anatomy of the AutoType Bypass
This vulnerability afflicts Fastjson versions spanning from 1.2.68 to 1.2.83. To orchestrate an attack, a malicious actor requires network access to a function that feeds user-controlled JSON payloads into the Fastjson library. Furthermore, the targeted application must operate as an executable Spring Boot archive laden with embedded dependencies, and the library’s safe mode must remain inactive.
Kirill Firsov, a distinguished researcher at FearsOff Cybersecurity, discovered this profound weakness. He uncovered that Fastjson processes the @type metadata field even when AutoType is explicitly disabled. During class name validation, the library endeavors to locate the corresponding resource via the class loader. By substituting a legitimate class name with a meticulously crafted uniform resource identifier, an attacker can compel the application to reach out to an external, malicious server.
From SSRF to Remote Code Execution
Initially, this technique facilitates a stealthy Server-Side Request Forgery (SSRF). Subsequently, the assailant can coerce the application into downloading a remote Java archive containing a malicious class. The @JSONType annotation embedded within this rogue class acts as a deceptive badge of trust, prompting Fastjson to circumvent certain security checks and attempt to instantiate the class.
In specific configurations running Java 8, the malicious payload detonates immediately upon the remote archive’s retrieval. However, commencing with Java 9, the runtime environment explicitly blocks class names containing specific characters, rendering the direct attack vector obsolete. Undeterred, Firsov engineered a sophisticated bypass for modern Java iterations utilizing the /proc/self/fd directory within Linux environments.
Upon downloading the remote archive, the Java Runtime Environment temporarily caches the file, opens it, and subsequently deletes the filename from the disk. Nevertheless, the file’s contents remain accessible via an open file descriptor. The attacker systematically enumerates these file descriptor numbers and redirects Fastjson to the path of the already-downloaded archive. Upon achieving a successful match, the library ingests the malicious class and executes its insidious code.
Exploitation Scope and Active Threats
Alibaba rigorously verified this attack vector across Spring Boot versions 2, 3, and 4, encompassing Java environments 8, 11, 17, and 21. The vulnerability’s success hinges entirely upon the specialized class loader utilized by executable Spring Boot archives. Conversely, standard Java archives, universal builds, and WAR applications destined for Tomcat or Jetty remain uncompromised, according to Alibaba’s official security advisory.
The hazardous payload can infiltrate functions such as JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Restricting input data to a specific class type does not invariably shield the application. The malicious field can be clandestinely nested within an object harboring the universal Object type or a Map structure.
Cybersecurity researchers actively monitor this threat landscape. Indeed, ThreatBook reported observing active exploitation attempts following the deployment of their detection rules. Although they successfully replicated the remote code execution within a Java 8 Spring Boot application, testing against an embedded Tomcat server solely yielded the downloading of the remote archive or a server-side request.
Similarly, Imperva detected suspicious activity targeting organizations across the financial, healthcare, retail, and technology sectors. The majority of these probing requests originated from the United States, with a minority emanating from Singapore and Canada. Notably, neither ThreatBook nor Imperva has disclosed the aggregate number of attacks, specific payload contents, victim identities, or definitive confirmations of successful breaches.
Mitigation Strategies and Legacy Vulnerabilities
As of late July, Alibaba has not released a patched iteration for the Fastjson 1.x lineage. The developers strongly advocate migrating to Fastjson2, which is impervious to this specific vulnerable mechanism. As a provisional safeguard, administrators can activate safe mode via the -Dfastjson.parser.safeMode=true parameter or deploy the restricted com.alibaba:fastjson:1.2.83_noneautotype build.
Enterprises are urged to meticulously audit their direct and transitive dependencies on Fastjson. Furthermore, security teams should actively scour their logs for anomalous @type values, references to nested Java archives, unexpected outbound network connections, the spawning of child processes, or the sudden emergence of novel files and web shells upon their servers.
In the wake of the 2022 AutoType bypass disclosure, security experts heralded Fastjson 1.2.83 as a secure upgrade. Ironically, this terminal version of the 1.x branch now finds itself squarely within the crosshairs of the Fastjson RCE CVE-2026-16723 vulnerability, serving as a stark reminder of the perpetual evolution of cyber threats.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
