● Covered by 1 source · 1 reportMedium impact1 negative
Fastjson 1.x RCE Vulnerability Actively Exploited, No Patch Available
Key points
- Fastjson 1.x RCE vulnerability (CVE-2026-16723) is being actively exploited.
- The flaw affects Spring Boot applications using Fastjson versions 1.2.68 through 1.2.83.
- No official patch is available for Fastjson 1.x; mitigation involves SafeMode or migration to Fastjson2.
- The vulnerability allows unauthenticated code execution without requiring AutoType or classpath gadgets.
Active Exploitation of Fastjson 1.x Vulnerability
Security firms ThreatBook and Imperva report that attackers are actively exploiting a critical remote code execution (RCE) vulnerability in Alibaba's Fastjson 1.x library for Java. This flaw, tracked as CVE-2026-16723, has a CVSS score of 9.0 and allows malicious JSON requests to execute code without authentication within affected Spring Boot applications.
Vulnerability Details and Prerequisites
The confirmed exploit chain requires Fastjson versions 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, and a network-reachable path that sends attacker-controlled JSON to an affected parser. SafeMode must be left at its default disabled state. The vulnerability does not require AutoType to be enabled or any classpath gadgets, making it easier to exploit. The issue stems from Fastjson's type-resolution path, where an attacker-controlled @type value can be turned into a class-resource lookup, allowing crafted bytecode to be fetched and loaded.
Lack of Patch and Mitigation Strategies
As of July 25, Alibaba has not released a patched version for Fastjson 1.x. Organizations unable to migrate immediately should enable SafeMode using the system property -Dfastjson.parser.safeMode=true or switch to the com.alibaba:fastjson:1.2.83_noneautotype variant. Alibaba recommends migrating to Fastjson2 as the long-term solution. The vulnerability primarily affects applications using Spring Boot executable fat-JARs; plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments are listed as unaffected.
Discovery and Impact
Alibaba published its advisory on July 21 following responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. Firsov's analysis confirmed the exploit chain on Spring Boot 2.x, 3.x, and 4.x with various JDK versions (8, 11, 17, and 21). ThreatBook reported capturing in-the-wild exploitation on July 22, shortly after adding detection support. The vulnerability's impact is significant for organizations relying on Fastjson 1.x in vulnerable configurations, as it allows for unauthenticated remote code execution.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Attackers are targeting a critical remote code execution (RCE) vulnerability in Alibaba's Fastjson 1.x library, affecting Spring Boot applications. The flaw, CVE-2026-16723, allows unauthenticated code execution and currently has no official patch from Alibaba for the 1.x branch. This impacts organizations using Fastjson 1.x in specific Spring Boot configurations, requiring immediate mitigation or migration to Fastjson2.