Alibaba and Spring Boot: Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Critical Fastjson Vulnerability (CVE-2026-16723) Under Active Exploitation

Security researchers from ThreatBook and Imperva have identified active exploitation of a critical vulnerability in Fastjson, Alibaba’s widely used JSON library for Java. Tracked as CVE-2026-16723 (CVSS 9.0), the flaw allows unauthenticated remote code execution (RCE) in Spring Boot applications when processing malicious JSON requests, executing code with the privileges of the Java process.

Key Details

• Affected Versions: Fastjson 1.2.68 through 1.2.83, when used in Spring Boot executable fat-JARs with SafeMode disabled (its default state).
• Exploitation Requirements: Attackers must send a crafted JSON payload to a network-reachable endpoint using vulnerable parsing methods (JSON.parse, JSON.parseObject). No AutoType enablement or classpath gadgets are required.
• Attack Vector: The flaw stems from Fastjson’s type-resolution mechanism, where an attacker-controlled @type value can trigger a class-resource lookup. In Spring Boot fat-JARs, this can fetch malicious bytecode via nested JAR paths or remote JAR downloads (including through /proc/self/fd on newer JDKs).
• Unaffected Deployments: Plain non-fat JARs, generic uber-JARs, and Tomcat/Jetty WAR deployments are not vulnerable.

Disclosure & Mitigation

• Disclosure: The vulnerability was responsibly reported by Kirill Firsov of FearsOff Cybersecurity and publicly disclosed by Alibaba on July 21.
• No Patch Available: As of July 25, Alibaba has not released a fixed Fastjson 1.x version. The recommended long-term solution is migrating to Fastjson2, which is unaffected.
• Workarounds:
  • Enable SafeMode (-Dfastjson.parser.safeMode=true).
  • Use the restricted build com.alibaba:fastjson:1.2.83_noneautotype.

Exploitation in the Wild

• ThreatBook detected in-the-wild attacks July 22, two days after adding detection rules. Their testing confirmed full RCE on JDK 8 in Spring Boot fat-JARs, though embedded Tomcat deployments only resulted in remote JAR fetches or SSRF.
• Imperva observed exploitation attempts targeting financial services, healthcare, computing, and retail sectors, primarily in the U.S., with smaller volumes in Singapore and Canada. Attackers used browser impersonators (70%), along with Ruby and Go tools (30%).
• No Confirmed Breaches: Neither vendor provided evidence of successful exploitation against real-world targets, and CISA’s Known Exploited Vulnerabilities (KEV) catalog does not currently list the flaw.

Technical Context

• The vulnerability bypasses previous mitigations, including Alibaba’s 2022 AutoType bypass patch (Fastjson 1.2.83), which now falls within the affected range.
• Fastjson2 is unaffected due to architectural changes in its resource-probing and annotation-based trust mechanisms.

Organizations are advised to audit direct and transitive Fastjson dependencies, monitor for suspicious @type values, unexpected outbound connections, and unauthorized child processes. No patched Fastjson 1.x release is available as of this report.

Source: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html

Alibaba Group cybersecurity rating report: https://www.rankiteo.com/company/alibaba-group

FastSpring cybersecurity rating report: https://www.rankiteo.com/company/fastspring

"id": "ALIFAS1784996806",
"linkid": "alibaba-group, fastspring",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Financial Services',
                        'location': 'U.S., Singapore, Canada',
                        'name': 'Financial services sector',
                        'type': 'Industry'},
                       {'industry': 'Healthcare',
                        'location': 'U.S.',
                        'name': 'Healthcare sector',
                        'type': 'Industry'},
                       {'industry': 'Computing',
                        'location': 'U.S.',
                        'name': 'Computing sector',
                        'type': 'Industry'},
                       {'industry': 'Retail',
                        'location': 'U.S.',
                        'name': 'Retail sector',
                        'type': 'Industry'}],
 'attack_vector': 'Network-reachable endpoint via crafted JSON payload',
 'date_detected': '2024-07-22',
 'date_publicly_disclosed': '2024-07-21',
 'description': 'Security researchers from ThreatBook and Imperva have '
                'identified active exploitation of a critical vulnerability in '
                'Fastjson, Alibaba’s widely used JSON library for Java. '
                'Tracked as CVE-2026-16723 (CVSS 9.0), the flaw allows '
                'unauthenticated remote code execution (RCE) in Spring Boot '
                'applications when processing malicious JSON requests, '
                'executing code with the privileges of the Java process.',
 'impact': {'systems_affected': 'Spring Boot applications using Fastjson '
                                '1.2.68 through 1.2.83 with SafeMode disabled'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'corrective_actions': ['Enable SafeMode',
                                                   'Use restricted Fastjson '
                                                   'build',
                                                   'Migrate to Fastjson2'],
                            'root_causes': 'Fastjson’s type-resolution '
                                           'mechanism allowing '
                                           'attacker-controlled @type values '
                                           'to trigger class-resource lookups '
                                           'in Spring Boot fat-JARs'},
 'recommendations': ['Audit direct and transitive Fastjson dependencies',
                     'Monitor for suspicious @type values in JSON requests',
                     'Monitor for unexpected outbound connections',
                     'Monitor for unauthorized child processes',
                     'Migrate to Fastjson2 for long-term mitigation'],
 'references': [{'source': 'ThreatBook'},
                {'source': 'Imperva'},
                {'date_accessed': '2024-07-21', 'source': 'Alibaba'},
                {'source': 'FearsOff Cybersecurity (Kirill Firsov)'}],
 'response': {'containment_measures': ['Enable SafeMode '
                                       '(-Dfastjson.parser.safeMode=true)',
                                       'Use restricted build '
                                       'com.alibaba:fastjson:1.2.83_noneautotype',
                                       'Migrate to Fastjson2'],
              'enhanced_monitoring': ['Audit Fastjson dependencies',
                                      'Monitor for suspicious @type values',
                                      'Monitor unexpected outbound connections',
                                      'Monitor unauthorized child processes']},
 'title': 'Critical Fastjson Vulnerability (CVE-2026-16723) Under Active '
          'Exploitation',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-16723'}