{"vulnerability": "cve-2026-1672", "sightings": [{"uuid": "c73c4ee0-7e5a-422f-9cdb-01f19723470c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/GithubRedTeam/95810", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EQSTLab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-30 07:44:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFastjson RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T09:00:03.412750Z"}, {"uuid": "96b095a1-b84f-4f71-9782-c4fddb566858", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/y-21MzKnE9UtyaE5ab_pL94fhj_dfFdxSXCYpnNpKZOg4AI", "content": "", "creation_timestamp": "2026-07-30T14:00:04.557693Z"}, {"uuid": "bdc6b5ae-90f3-4455-a3a3-6750f38f4c77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16727", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrth53myr32r", "content": "ASUS Armoury Crate 5.4.1 hit by HIGH severity race condition (CVE-2026-16727). Local attackers can escalate privileges. No patch yet \u2014 restrict access & watch for suspicious activity. https://radar.offseq.com/threat/cve-2026-16727-cwe-362-concurrent-execution-using-shared-resource-with-improper-s...", "creation_timestamp": "2026-07-30T03:00:27.512435Z"}, {"uuid": "fc4287d8-e140-469f-beed-76f787aaf8f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16728", "type": "seen", "source": "https://gist.github.com/alon710/51c65a255f770cf34523cbf52ef9595a", "content": "# CVE-2026-16728: CVE-2026-16728: Downstream HTTP Response Desynchronization in Undici Retry Interceptor\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-16728\n\n## Summary\nA medium-severity vulnerability in Undici's retry interceptor causes body-length mismatches with the Content-Length header during HTTP 206 response resumption. Forwarding these inconsistent headers downstream leads to HTTP response desynchronization, connection hangs, or potential protocol smuggling.\n\n## TL;DR\nUndici's retry interceptor failed to validate the Content-Length header against actual bytes received when retrying broken HTTP 206 Partial Content responses, creating desynchronization risks in downstream proxies.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.8\n- **EPSS Score**: 0.00164\n- **Impact**: HTTP Response Desynchronization, Client Connection Hangs, Protocol Smuggling\n- **Exploit Status**: poc\n- **Kev Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications using undici library with retry interceptor enabled\n- **undici**: < 6.28.0 (Fixed in: `6.28.0`)\n- **undici**: >= 7.0.0, < 7.29.0 (Fixed in: `7.29.0`)\n- **undici**: >= 8.0.0, < 8.9.0 (Fixed in: `8.9.0`)\n\n## Mitigation\n\n- Upgrade the Undici dependency to a patched version (6.28.0, 7.29.0, or 8.9.0 or higher).\n- Recalculate the Content-Length header in middlebox or reverse-proxy code before forwarding headers downstream.\n- Strip the Content-Length header and utilize chunked transfer encoding (Transfer-Encoding: chunked) for downstream proxy responses.\n\n**Remediation Steps:**\n1. Identify all Node.js projects utilizing the undici library by examining package.json and package-lock.json files.\n2. Update undici to version 6.28.0 (for 6.x), 7.29.0 (for 7.x), or 8.9.0 (for 8.x) using the package manager.\n3. Ensure any proxy or gateway routes do not blindly trust and forward the Content-Length header from upstream servers without validation.\n4. Execute testing suites with test cases that mimic interrupted range responses to verify that connections reject invalid frames appropriately.\n\n## References\n\n- [GitHub Security Advisory GHSA-8xcm-r25x-g524](https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [CVE-2026-16728 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-16728)\n- [NVD - CVE-2026-16728 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-16728)\n- [Fix Commit in Undici Repository](https://github.com/nodejs/undici/commit/1b5a5312c3a7d7a30c31bf0d000b39a8a2531e1c)\n- [Refactor/Abort Commit in Undici Repository](https://github.com/nodejs/undici/commit/cba3a52ac2e7abcc4e656d82af8579ea82c2bb9e)\n- [Test Corrections - Range boundary updates (Commit 1)](https://github.com/nodejs/undici/commit/2b3f749336d356bbbc50192f87f6cf7bc714721a)\n- [Test Corrections - Range boundary updates (Commit 2)](https://github.com/nodejs/undici/commit/4a9dafb16ff43880cf590e6d9c2aeee25fbff6d7)\n- [Test Corrections - Range boundary updates (Commit 3)](https://github.com/nodejs/undici/commit/4fd5a0c61e627f928b7003adc4ffe1e55ec63420)\n- [Undici Release Tag v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0)\n- [Undici Release Tag v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0)\n- [Undici Release Tag v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-16728) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T14:32:21.375709Z"}, {"uuid": "ffe83fb7-d48e-41e0-9321-b25defb46deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/4UmGIQtfBl8KQZeNab7MkdV3KJBv_MFiZ_bvWr3ttjSdt98", "content": "", "creation_timestamp": "2026-07-30T19:00:04.342985Z"}, {"uuid": "d54a5c4d-631a-431e-ba97-e7e377813172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3msbk2s5n5d2p", "content": "\ud83d\udce2 Exploitation active de CVE-2026-16723 dans Fastjson : RCE sans authentification\n\nSecurityWeek, publi\u00e9 le 28 juillet 2026. L'article rapporte l'exploitation active d'une vuln\u00e9rabilit\u00e9 critique dans Fastjson, une biblioth\u00e8que Java de\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#Fastjson #RCE #Cyberveille", "creation_timestamp": "2026-08-04T17:30:07.906190Z"}, {"uuid": "1282db0d-8b0e-494c-b2be-19d2e4715e7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/4UmGIQtfBl8KQZeNab7MkdV3KJBv_MFiZ_bvWr3ttjSdt98", "content": "", "creation_timestamp": "2026-07-31T00:00:23.866846Z"}, {"uuid": "5b4a8e9c-df14-4eb2-b8a8-1e35da576c32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95810", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EQSTLab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-30 07:44:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFastjson RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T00:00:35.843995Z"}, {"uuid": "1fe1713f-53bf-42d7-9c74-3c3305f48335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/y-21MzKnE9UtyaE5ab_pL94fhj_dfFdxSXCYpnNpKZOg4AI", "content": "", "creation_timestamp": "2026-07-31T01:00:14.695728Z"}, {"uuid": "39976760-96cb-4067-beb0-9012201e1ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96434", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #\u6f0f\u6d1e #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fastjson-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a xiaoqiMikko\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 13:02:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFind fastjson in your JARs and Spring Boot fat-JARs, and check exposure to CVE-2026-16723. Zero dependencies, fully offline. \u4e00\u6761\u547d\u4ee4\u6392\u67e5 fastjson \u6f0f\u6d1e\u5f71\u54cd\u8303\u56f4\u3002\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T14:00:05.001512Z"}, {"uuid": "a81fa453-6fe4-4353-abb3-9901aca7e91b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxodedyc2o", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-16729 impacts undici in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/646\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:01:04.317077Z"}, {"uuid": "1a810abb-8657-44f7-b920-8b318a5d7dad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16728", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxocasct2i", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-16728 impacts undici in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/645\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:01:00.827683Z"}, {"uuid": "170cd28a-dd45-4952-872c-ccee55cbd5a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/fRn9WLRC1KE6ry6fn3owOvcDc4IpJXFhnXNgjnu-Gc8v93I", "content": "", "creation_timestamp": "2026-08-03T16:00:05.228317Z"}, {"uuid": "f077194f-5b79-40f7-af1f-e21afb62fa7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/GithubRedTeam/96024", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Nowafen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 14:20:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA critical vulnerability affecting Fastjson versions 1.2.68 \u2013 1.2.83.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T16:00:03.945411Z"}, {"uuid": "bb29e75b-e45b-489c-91ff-dd515a84aca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/GithubRedTeam/96040", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 1xPwn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 14:20:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA critical vulnerability affecting Fastjson versions 1.2.68 \u2013 1.2.83.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-31T18:00:04.131187Z"}, {"uuid": "a8b593b1-540b-49c5-bfdf-b8e17ee617d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0H_ENlFRwe45W-O_e0iQ", "content": "", "creation_timestamp": "2026-07-31T22:00:02.776788Z"}, {"uuid": "11bee2fe-9600-443b-a261-8b4dc13ecf4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/GithubRedTeam/96040", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 1xPwn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 14:20:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA critical vulnerability affecting Fastjson versions 1.2.68 \u2013 1.2.83.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-01T00:00:25.565035Z"}, {"uuid": "2e17aea4-9dfd-443a-9277-45ad039b81f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0H_ENlFRwe45W-O_e0iQ", "content": "", "creation_timestamp": "2026-08-01T00:00:10.970300Z"}, {"uuid": "0a0a8a01-6d21-44e2-9452-971f004da23a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/GithubRedTeam/96024", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Nowafen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-31 14:20:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA critical vulnerability affecting Fastjson versions 1.2.68 \u2013 1.2.83.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-01T00:00:27.519646Z"}, {"uuid": "e449f266-b00c-408a-8fde-0f24b462f552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96434", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #\u6f0f\u6d1e #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fastjson-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a xiaoqiMikko\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 13:02:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFind fastjson in your JARs and Spring Boot fat-JARs, and check exposure to CVE-2026-16723. Zero dependencies, fully offline. \u4e00\u6761\u547d\u4ee4\u6392\u67e5 fastjson \u6f0f\u6d1e\u5f71\u54cd\u8303\u56f4\u3002\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T00:00:37.828561Z"}, {"uuid": "c9d71587-e6de-494f-9cfb-fadbb8ae8b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/fRn9WLRC1KE6ry6fn3owOvcDc4IpJXFhnXNgjnu-Gc8v93I", "content": "", "creation_timestamp": "2026-08-04T00:00:33.481651Z"}, {"uuid": "a2864bcb-a4a1-4d69-ba08-72c058607ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://gist.github.com/alon710/95d41625eb91d5b304c0c5ed76c502de", "content": "# CVE-2026-16729: CVE-2026-16729: Cookie Attribute Injection in Undici via Unsanitized Domain and Unparsed Fields\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-16729\n\n## Summary\nCVE-2026-16729 (GHSA-v3r7-h72x-cjcm) is a medium-severity cookie attribute injection vulnerability in Undici's web-compliant cookie utility module. Due to insufficient validation of domain parameters and raw attributes in the unparsed options array, arbitrary attributes like SameSite, HttpOnly, and Secure can be injected. This allows attackers to bypass CSRF protections, strip security flags, or override intended cookie behaviors when applications pass user-controlled values to these properties.\n\n## TL;DR\nA vulnerability in Undici allows remote attackers to inject arbitrary cookie attributes (such as SameSite, HttpOnly, and Secure) via unsanitized domain inputs and custom unparsed options arrays, undermining core web-security mitigations like CSRF protections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.8\n- **Exploit Status**: poc\n- **CISA KEV Status**: No\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Undici HTTP Client (Node.js)\n- **undici**: < 6.28.0 (Fixed in: `6.28.0`)\n- **undici**: >= 7.0.0 < 7.29.0 (Fixed in: `7.29.0`)\n- **undici**: >= 8.0.0 < 8.9.0 (Fixed in: `8.9.0`)\n\n## Mitigation\n\n- Upgrade Undici to patched versions (6.28.0, 7.29.0, or 8.9.0).\n- Sanitize and validate user-supplied domains at the application layer using strict RFC 1123 compliance checks.\n- Block semicolon (`;`) characters in any user inputs mapped directly to HTTP headers or cookie options.\n- Implement deep validation on keys and values populated into the custom `unparsed` cookie configuration array.\n\n**Remediation Steps:**\n1. Identify the active version of Undici inside your project environment using commands like `npm ls undici` or `yarn why undici`.\n2. Upgrade Undici to the latest secure version: run `npm install undici@latest` or configure an explicit dependency override in package.json.\n3. Implement application-level sanitization filters on all domain inputs used in cookie configurations.\n4. Deploy code fixes and perform automated integration testing to ensure cookie header structures remain intact.\n\n## References\n\n- [GHSA-v3r7-h72x-cjcm Security Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-16729)\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-16729)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-16729)\n- [Undici Release v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0)\n- [Undici Release v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0)\n- [Undici Release v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-16729) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T13:32:13.639360Z"}, {"uuid": "4e43a0ee-458d-46ee-b78d-c2d6ba5d9531", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96734", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fastjson-cve-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a learner330\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 09:44:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-05T11:00:04.969884Z"}, {"uuid": "d05b80f1-41fa-4daa-a607-973ea528f0ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/UbZK-VwPh9l1pYbayMasyiZCPeV7grgX0EQqpt0r3m8Unos", "content": "", "creation_timestamp": "2026-08-05T21:00:03.634055Z"}, {"uuid": "092b1ad3-8a96-48dd-93bd-5732839bbe98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/UbZK-VwPh9l1pYbayMasyiZCPeV7grgX0EQqpt0r3m8Unos", "content": "", "creation_timestamp": "2026-08-06T00:00:09.990451Z"}, {"uuid": "eab6b017-1559-436a-9c74-675f79cdc3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96734", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Fastjson #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fastjson-cve-2026-16723\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a learner330\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 09:44:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-06T00:00:44.542758Z"}, {"uuid": "c0dfe15f-3e2f-43d8-8f2a-0724f8dd6cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/miFQN7X72jRRW6EY2gS7CQFdpGF0_8e-raRmF79rh9lBiw", "content": "", "creation_timestamp": "2026-08-06T07:00:04.058431Z"}, {"uuid": "6c43de08-e674-457d-bf08-fecdd5e9d039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/belinski.dev/post/3msfkrk4aqc2m", "content": "A very easy to read article about discovery of CVE-2026-16723 (RCE in fastjson) and some details of how #Java Class Loaders and Resource Handling work.\n#cybersecurity\nfearsoff.org/research/fas...", "creation_timestamp": "2026-08-06T07:53:33.544623Z"}, {"uuid": "8e70ec4d-2a52-496e-9d16-df49deeae7d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/miFQN7X72jRRW6EY2gS7CQFdpGF0_8e-raRmF79rh9lBiw", "content": "", "creation_timestamp": "2026-08-07T00:17:18.400776Z"}, {"uuid": "da0b10a6-eac1-4425-9606-0e6046b99331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrch7ck5e62q", "content": "\ud83d\udd34 EXPLOITED\n\nA critical flaw in fastjson, a widely used Java data library, lets a stranger run code on the server in its default setup. (CVE-2026-16723)\n\nHits fastjson 1.2.68 to 1.2.83; turning AutoType off does not help.\n\nFix: enable SafeMode or move to fastjson2.", "creation_timestamp": "2026-07-23T08:46:26.325217Z"}, {"uuid": "7b33e5de-813f-42bd-b4fd-45ff7d456f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16723", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116968471131630189", "content": "CVE-2026-16723: CRITICAL RCE in Alibaba Fastjson 1.2.68. Exploitable under default config \u2014 no patch yet. Avoid 1.2.68 & monitor vendor updates for mitigation. CVSS 9.0. https://radar.offseq.com/threat/cve-2026-16723-cwe-20-improper-input-validation-in-alibaba-fastjson-939ed165aac7ce81 #OffSeq #infosec #CVE202616723 #remotecodeexecution", "creation_timestamp": "2026-07-23T09:00:28.652976Z"}, {"uuid": "5aea316a-03f4-4ca7-818c-13d5d575e54e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16723", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrchyhlrvl25", "content": "CRITICAL RCE found in Alibaba Fastjson 1.2.68 (CVE-2026-16723). Remote exploit possible by default config. No patch available \u2014 avoid affected version, monitor for updates. https://radar.offseq.com/threat/cve-2026-16723-cwe-20-improper-input-validation-in-alibaba-fastjson-939ed165aac7ce81 #OffSeq...", "creation_timestamp": "2026-07-23T09:00:30.460814Z"}, {"uuid": "0d76303b-913f-4ed1-b9ca-c41545fdfaf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrcyiy4vmz2j", "content": "CVE-2026-16723 - fastjson\nFastjson versions 1.2.68 to 1.2.83 are vulnerable to a serious security risk. This means an attacker could potentially take control of your system by sending malicious data. You\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#fastjson #alibaba #CVE #infosec", "creation_timestamp": "2026-07-23T13:56:04.346525Z"}, {"uuid": "4c673004-5b8d-449a-9d38-d2017cb527e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrgsqxehey2l", "content": "FastJson RCE vulnerability CVE-2026-16723 is exploited in the wild. Details and PoC exploit code are public for this critical remote code execution flaw.\n\n#FastJson #CVE202616723 #RCE #ZeroDay", "creation_timestamp": "2026-07-25T02:23:48.708650Z"}, {"uuid": "ada1b63a-1c35-418e-93c3-5a81d3dca717", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac903c11-aca3-458f-a80d-d45bf742c563", "content": "", "creation_timestamp": "2026-07-25T12:00:27.603734Z"}, {"uuid": "b1e8dfa3-9973-4020-923b-9a5a654ae363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16723", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mrhzwo66tx2c", "content": "Fastjson 1.x zero-day (CVE-2026-16723): unauthenticated RCE, no patch available. Legacy Fastjson in ICS or critical infra should be treated as exposed now. #ThreatIntel #ICS #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/fastjson-1x-rce-cve-2026-16723-no-patch-2026", "creation_timestamp": "2026-07-25T14:04:56.562808Z"}, {"uuid": "ee80eb10-bd20-40f6-ae67-badc86a0c44d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-25T23:00:03.205255Z"}, {"uuid": "3cc0a823-2f3a-4e51-b3ca-83455961612f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mriyo2it4n2s", "content": "\ud83e\udd16 CVE-2026-16723 (CVSS 9.0): RCE in Alibaba Fastjson 1.x affecting Spring Boot apps. No patch available \u2014 actively exploited. Unauthenticated JSON requests can execute code.\nhttps://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html", "creation_timestamp": "2026-07-25T23:14:52.891898Z"}, {"uuid": "cdf77187-416f-4881-b205-f97a96d91050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/nPdorxgilRpeUK74owvb_SQJPx7ceIG4883buRWavnmG2X8", "content": "", "creation_timestamp": "2026-07-25T20:00:03.395772Z"}, {"uuid": "d3ad9086-a555-4b1b-b00e-0828969ade33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mri4zucu4h2o", "content": "CVE-2026-16723 is being exploited in Spring Boot fat-JAR apps using Fastjson 1.x, enabling unauthenticated code execution. No patched 1.x fix is available yet; Alibaba advises SafeMode or migration. #Fastjson #SpringBoot #Alibaba", "creation_timestamp": "2026-07-25T15:00:24.934172Z"}, {"uuid": "e723ab39-7cf2-41a7-9d7f-5a916ed13793", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/miFQN7X72jRRW6EY2gS7CQFdpGF0_8e-raRmF79rh9lBiw", "content": "", "creation_timestamp": "2026-07-25T15:00:20.705715Z"}, {"uuid": "c0a5924e-076a-43b7-91dd-9614c03c17e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mri5flcwiv2p", "content": "\ud83e\udd16 CVE-2026-16723 (CVSS 9.0): Critical RCE in Alibaba's Fastjson 1.x actively exploited \u2014 no patch available. Malicious JSON \u2192 RCE on Spring Boot apps. https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html", "creation_timestamp": "2026-07-25T15:06:57.536207Z"}, {"uuid": "0df6765d-ca43-4f32-8e85-eeeaeeeb71d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mri5mwjthc2s", "content": "Critical Spring Boot Security Alert: CVE-2026-16723 Exposes Fastjson Applications to Unauthenticated Remote Code Execution +\u00a0Video\n\nIntroduction: A New Java Security Threat Emerges The cybersecurity community is warning developers and organizations about a newly exploited vulnerability affecting\u2026", "creation_timestamp": "2026-07-25T15:11:05.202419Z"}, {"uuid": "dfc06994-533a-458c-8b61-03596d7579b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html", "content": "Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.\n\nTracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires", "creation_timestamp": "2026-07-25T16:00:51.995052Z"}, {"uuid": "de443f7a-3dd5-4a53-845a-5cb08ba2e0e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-26T00:00:28.302345Z"}, {"uuid": "d39ee5b4-2473-4030-b431-4d953133c17d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/nPdorxgilRpeUK74owvb_SQJPx7ceIG4883buRWavnmG2X8", "content": "", "creation_timestamp": "2026-07-26T00:00:32.428976Z"}, {"uuid": "55c9b120-2ae8-4afd-8dd5-2bb25c29f0d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/116985918688365538", "content": "FastJson 1.2.83 RCE (CVE-2026-16723) https://fearsoff.org/research/fastjson-1-2-83-rce", "creation_timestamp": "2026-07-26T10:57:36.958191Z"}, {"uuid": "28a38833-36ee-43e5-8cde-db040bf18ee6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mrk7wpxalfm2", "content": "FastJson 1.2.83 RCE (CVE-2026-16723) https://fearsoff.org/research/fastjson-1-2-83-rce", "creation_timestamp": "2026-07-26T10:57:46.267448Z"}, {"uuid": "d1043db6-664e-46f8-a5ca-c240d342d2f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/miFQN7X72jRRW6EY2gS7CQFdpGF0_8e-raRmF79rh9lBiw", "content": "", "creation_timestamp": "2026-07-26T00:00:44.915683Z"}, {"uuid": "840f5fa6-f98a-42f4-9031-6fb121409559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html", "content": "Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.\n\nTracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires", "creation_timestamp": "2026-07-26T01:01:04.274894Z"}, {"uuid": "8f4e239f-d083-4d4a-87f7-4f3050c2e493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mrljybienv2m", "content": "ThreatBook & Imperva warn attackers exploit CVE-2026-16723, a critical flaw in Alibaba's Fastjson (CVSS 9.0). Malicious JSON can execute code in Spring Boot apps without auth. Stay updated!", "creation_timestamp": "2026-07-26T23:30:08.772614Z"}, {"uuid": "44d759c3-5e54-470e-b937-ca1053101c10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mrk2rpyxzq2p", "content": "\ud83e\udd16 CVE-2026-16723 (CVSS 9.0): Critical unauthenticated RCE in Alibaba Fastjson 1.x, actively exploited with no patch available. Affects Spring Boot applications.\nhttps://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html", "creation_timestamp": "2026-07-26T09:25:23.849096Z"}, {"uuid": "25064848-5f2e-4d6d-85d6-9b1ac1877960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mrluzajiyn2t", "content": "FastJson\u306eRCE\u8106\u5f31\u6027CVE-2026-16723\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3001\u8a73\u7d30\u3068PoC\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u30b3\u30fc\u30c9\u304c\u516c\u958b\u3055\u308c\u305f \n\nFastJson RCE CVE-2026-16723 Exploited in the Wild as Details and PoC Exploit Code Go Public  #DailyCyberSecurity (Jul 25)\n\nsecurityonline.info/fastjson-rce...", "creation_timestamp": "2026-07-27T02:47:32.918878Z"}, {"uuid": "d9c7e638-5501-40b7-8595-a999f5c5adff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/techoverload.bsky.social/post/3mrmz5s2mwl2w", "content": "Fastjson 1.x RCE (CVE-2026-16723) is being actively exploited \u2014 and there's no patch. A single malicious JSON request can run code on Spring Boot fat-JAR apps without auth. If you use Fastjson 1.x, enable SafeMode or migrate to fastjson2 now. \ud83d\uded1\n\n#Cybersecurity #Java #Security", "creation_timestamp": "2026-07-27T13:34:19.922932Z"}, {"uuid": "69bc62e0-3df8-44b7-8646-23a510cca426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/bdufstecru/3346", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 AutoType \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Java Fastjson \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-10492\nCVE-2026-16723\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83", "creation_timestamp": "2026-07-27T16:00:06.299064Z"}, {"uuid": "81904328-cb23-4707-81ca-26ed8e7add12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16723", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mrnenzzeim2q", "content": "\ud83d\udce2 CVE-2026-16723 : RCE dans FastJson 1.2.83 via SSRF et chargement de classe distante\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nPubli\u00e9 le 21 juillet 2026 par la soci\u00e9t\u00e9 FearsOff \u2026\nhttps://cyberveille.ch/posts/2026-07-27-cve-2026-16723-rce-dans-fastjson-1-2-83-via-ssrf-et-chargement-de-classe-distante/ #AutoType #Cyberveille", "creation_timestamp": "2026-07-27T17:00:16.125108Z"}, {"uuid": "03a17299-fb77-4439-86b7-736f56870e17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3346", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 AutoType \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Java Fastjson \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-10492\nCVE-2026-16723\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83", "creation_timestamp": "2026-07-28T00:00:31.966112Z"}, {"uuid": "64b92ed9-4ee8-44f1-8505-d5c1bd1b5792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mro4uxcuhk2e", "content": "Fastjson 1.x users, listen up: A critical RCE zero-day (CVE-2026-16723) is being actively exploited against US financial, healthcare, and retail firms. The worst part? There's no official patch, leaving even updated systems\u2026\n\nhttps://www.tpp.blog/12lb7zq\n\n#cybersecurity #fastjson #cve202616723", "creation_timestamp": "2026-07-28T00:13:38.131330Z"}, {"uuid": "4b13c38e-1387-4864-a02d-11c19dd090de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mroctugfrm2j", "content": "Hackers are exploiting FastJson CVE-2026-16723 for remote code execution without interaction or privileges, with U.S. firms in finance, healthcare, retail, and tech among the main targets. #FastJson #USA #RCE", "creation_timestamp": "2026-07-28T02:00:23.937442Z"}, {"uuid": "5b5cbb07-905f-4f1e-bdc0-68f46b79b450", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mrodij64xh2z", "content": "FastJson CVE-2026-16723 Exploited in Real-World Attacks as Hackers Target US Organizations Through Critical Remote Code Execution Flaws +\u00a0Video\n\nIntroduction: A New Wave of Exploitation Shows How Fast Vulnerabilities Become Weapons The cybersecurity landscape continues to demonstrate a dangerous\u2026", "creation_timestamp": "2026-07-28T02:11:56.981638Z"}, {"uuid": "643c9cf2-4ac5-4c18-a0f2-fb8862ae6e95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/GithubRedTeam/95452", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fastjson-rce-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a why-success\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 02:58:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFastjson 1.2.83 RCE \u9776\u573a\u73af\u5883 (CVE-2026-16723)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-28T04:00:05.259936Z"}, {"uuid": "b8b1d15f-982c-47e1-8927-d33bbc92f694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mrp35pxz222m", "content": "Critical Fastjson RCE CVE-2026-16723 is being actively exploited in Spring Boot fat-jar deployments and Fastjson 1.x. Fastjson 2.x or SafeMode reduces exposure. #Fastjson #CVE2026 #Alibaba", "creation_timestamp": "2026-07-28T09:15:24.637233Z"}, {"uuid": "e0693a99-b494-4b5a-b4f0-7cc55611b412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/HackerNewscyber/3292", "content": "\u2708\ufe0f \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 FortiOS \u0648 Fastjson \u0639\u0644\u06cc\u200c\u0628\u0627\u0628\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\n\n\ud83c\udfa5\u0641\u0648\u0631\u062a\u06cc\u0646\u062a \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 SSL-VPN \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 FortiOS \u062e\u0628\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0627 \u0627\u0631\u0633\u0627\u0644 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc HTTP \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc\u200c\u0634\u062f\u0647\u060c \u0648\u0635\u0644\u0647\u200c\u06cc \u0642\u0628\u0644\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645 symbolic link \u0631\u0627 \u062f\u0648\u0631 \u0628\u0632\u0646\u062f\u061b \u0627\u0644\u0628\u062a\u0647 \u067e\u06cc\u0634\u200c\u0634\u0631\u0637 \u0622\u0646\u060c \u0646\u0641\u0648\u0630 \u0642\u0628\u0644\u06cc \u0645\u0647\u0627\u062c\u0645 \u0628\u0647 \u0633\u0637\u062d \u0641\u0627\u06cc\u0644\u200c\u0633\u06cc\u0633\u062a\u0645 \u062f\u0633\u062a\u06af\u0627\u0647 \u0627\u0633\u062a. \u062c\u0632\u0626\u06cc\u0627\u062a \u0646\u062d\u0648\u0647 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0648 \u0639\u0627\u0645\u0644 \u062d\u0645\u0644\u0627\u062a \u0647\u0646\u0648\u0632 \u0645\u0634\u062e\u0635 \u0646\u06cc\u0633\u062a \u0648 \u0622\u0698\u0627\u0646\u0633\u200c\u0647\u0627\u06cc \u0641\u062f\u0631\u0627\u0644 \u0622\u0645\u0631\u06cc\u06a9\u0627 \u062a\u0627 \u06f1\u06f0 \u0627\u0648\u062a \u06f2\u06f0\u06f2\u06f6 \u0645\u0647\u0644\u062a \u062f\u0627\u0631\u0646\u062f \u0648\u0635\u0644\u0647 \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n\ud83c\udfa5\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u06cc\u06af\u0631\u060c CVE-2026-16723 \u0628\u0627 \u0627\u0645\u062a\u06cc\u0627\u0632 \u06f9.\u06f0 \u0627\u0632 \u06f1\u06f0\u060c \u062f\u0631 \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 Fastjson \u0639\u0644\u06cc\u200c\u0628\u0627\u0628\u0627 \u0627\u0633\u062a \u06a9\u0647 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062a\u0639\u0627\u0645\u0644 \u06a9\u0627\u0631\u0628\u0631 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0647\u0646\u0648\u0632 \u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647 \u0648 \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06f1.\u06f2.\u06f6\u06f8 \u062a\u0627 \u06f1.\u06f2.\u06f8\u06f3 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0641\u0648\u0631\u0627\u064b SafeMode \u0631\u0627 \u0641\u0639\u0627\u0644 \u06cc\u0627 \u0628\u0647 \u0646\u0633\u062e\u0647 \u0627\u0645\u0646 \u0645\u0647\u0627\u062c\u0631\u062a \u06a9\u0646\u0646\u062f.\n\n\n\u2708\ufe0f @HackerNewsCyber", "creation_timestamp": "2026-07-28T11:00:06.765506Z"}, {"uuid": "0a9e10df-6b0a-40e5-bf4c-69e9b532b512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/TTDc5m9rjxOF-FLNkY4srXBXmccnJEZ8Ua1WlC6sUt3lKgo", "content": "", "creation_timestamp": "2026-07-28T14:00:05.142521Z"}, {"uuid": "8748b749-acf3-4221-ba6e-23f94bf22548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "Telegram/sy-gY02N2vY61unP8KTQmhG6Lrt3BtaNuULshxLDg-pvnZw", "content": "", "creation_timestamp": "2026-07-28T14:00:05.221623Z"}, {"uuid": "ceffb140-142e-49c2-bd2f-81cf2bbc8966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/true_secator/8450", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 Java-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 FastJson, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0443\u0447\u0430\u0441\u0442\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\nFastJson - \u044d\u0442\u043e \u043e\u0434\u043d\u0430 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0432 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Java \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c,\u00a0\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u0430\u044f Alibaba, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 JSON.\n\n\u041f\u0440\u043e\u0435\u043a\u0442 \u0438\u043c\u0435\u0435\u0442 25 600 \u0437\u0432\u0435\u0437\u0434 \u0438 6 400 \u0444\u043e\u0440\u043a\u043e\u0432 \u043d\u0430 GitHub \u0438 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u0435\u043d \u0432 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u041f\u041e \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Alibaba.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 FastJson \u043e\u0442 1.2.68 \u0434\u043e 1.2.83. \u042d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0432\u0435\u0442\u043a\u0438 1.x, \u0431\u044b\u043b\u0430 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u0430 \u0432 \u043c\u0430\u0435 2022 \u0433\u043e\u0434\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u044d\u0442\u043e \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u043d\u043e \u043e\u043d\u0430, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u043e\u0439 \u0438 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f FearsOff \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e \u043d\u0435\u0439.\n\n\u0410\u0442\u0430\u043a\u0438, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 Imperva \u0438 ThreatBook, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0CVE-2026-16723, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 Fastjson \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u043e\u043d\u0430 \u00ab\u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u043a\u0440\u0443\u0433 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0443\u0441\u043b\u0443\u0433, \u0437\u0434\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f, \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439, \u0440\u043e\u0437\u043d\u0438\u0447\u043d\u043e\u0439 \u0442\u043e\u0440\u0433\u043e\u0432\u043b\u0438, \u0431\u0438\u0437\u043d\u0435\u0441\u0430 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u044f\u0445\u00bb.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0447\u0442\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0431\u0430\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0421\u0428\u0410, \u043d\u0430\u0440\u044f\u0434\u0443 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u0438 \u041a\u0430\u043d\u0430\u0434\u0435, \u0445\u043e\u0442\u044f, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u044d\u0442\u0430 \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0442\u044c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043b\u043e\u0433\u0438\u043a\u043e\u0439 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0442\u0438\u043f\u043e\u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f AutoType. \u042d\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 Spring Boot \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c fat-JAR-\u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 type, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u0431\u0435\u0437 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 AutoType \u0438 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0446\u0435\u043f\u043e\u0447\u0435\u043a \u0433\u0430\u0434\u0436\u0435\u0442\u043e\u0432.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 Alibaba \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u00ab\u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u043e\u0439 \u043c\u043e\u0434\u0435\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Spring Boot\u00bb.\n\n\u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0443\u0441\u043b\u043e\u0432\u0438\u0435\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e, \u0447\u0442\u043e \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043e\u0431\u044a\u0435\u043a\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b Spring Boot fat-jar (\u0442.\u0435., \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b java -jar xxx.jar).\n\n\u041f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 CVE-2026-16723, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0432 \u043f\u043e\u043b\u044f \u00abObject\u00bb \u0438\u043b\u0438 \u00abMap\u00bb.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0442\u0438\u043f\u043e\u0432 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 fastjson2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u043e\u0434\u0435\u043b\u044c \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u0442\u0438\u043f\u043e\u0432 \u0434\u043b\u044f \u043f\u043e\u043b\u0438\u043c\u043e\u0440\u0444\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u043d\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0430\u043d\u043d\u043e\u0442\u0430\u0446\u0438\u044e JSONType \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0438\u0433\u043d\u0430\u043b\u0430 \u0434\u043e\u0432\u0435\u0440\u0438\u044f.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u0435\u0440\u0441\u0438\u0438 FastJson 1.2.60 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043b\u044e\u0431\u044b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0444\u043e\u0440\u043c\u0430\u0442 fat-JAR, \u0442\u0430\u043a\u0436\u0435 \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u0432\u0435\u0440\u0441\u0438\u044e \u0438\u0437 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0433\u043e \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c (SafeMode) \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u0441\u0431\u043e\u0440\u043a\u0443, \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0443\u044e \u044d\u0442\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f CVE-2026-16723 \u043d\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043e. Imperva \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e FastJson 1.x \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u0430\u043b\u043e\u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.", "creation_timestamp": "2026-07-28T16:00:08.763361Z"}, {"uuid": "8cbc9e9f-0b3f-4ed6-9789-ebed67245954", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mrq6baejpx2u", "content": "\ud83d\udd34 EXPLOITED\n\nFastjson 1.x, a widely used Java JSON library, has a critical flaw (CVE-2026-16723) now exploited against US firms.\n\nOnly Spring Boot fat-JAR apps are hit, and 1.x is end-of-life.\n\nThe fix is fastjson2.", "creation_timestamp": "2026-07-28T19:43:44.097863Z"}, {"uuid": "23202269-db48-415c-9141-dc6348e49b9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mrqgjbzqll2o", "content": "A critical RCE vulnerability in Fastjson (CVE-2026-16723) affects versions 1.2.68 to 1.2.83, allowing code execution in Spring Boot applications via malicious JSON requests. Alibaba has not released a patch as of July 25. Organizations are advised to enable SafeMode or migrate to Fastjson2.", "creation_timestamp": "2026-07-28T22:11:24.189367Z"}, {"uuid": "06a245af-f4c4-4d6c-ad33-e50731508077", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "exploited", "source": "https://t.me/true_secator/8450", "content": "\u0425\u0430\u043a\u0435\u0440\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 Java-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 FastJson, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0443\u0447\u0430\u0441\u0442\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\nFastJson - \u044d\u0442\u043e \u043e\u0434\u043d\u0430 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0432 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Java \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c,\u00a0\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u0430\u044f Alibaba, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 JSON.\n\n\u041f\u0440\u043e\u0435\u043a\u0442 \u0438\u043c\u0435\u0435\u0442 25 600 \u0437\u0432\u0435\u0437\u0434 \u0438 6 400 \u0444\u043e\u0440\u043a\u043e\u0432 \u043d\u0430 GitHub \u0438 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u0435\u043d \u0432 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u041f\u041e \u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Alibaba.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 FastJson \u043e\u0442 1.2.68 \u0434\u043e 1.2.83. \u042d\u0442\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0432\u0435\u0442\u043a\u0438 1.x, \u0431\u044b\u043b\u0430 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u0430 \u0432 \u043c\u0430\u0435 2022 \u0433\u043e\u0434\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u044d\u0442\u043e \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u043d\u043e \u043e\u043d\u0430, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u043e\u0439 \u0438 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f FearsOff \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e \u043d\u0435\u0439.\n\n\u0410\u0442\u0430\u043a\u0438, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 Imperva \u0438 ThreatBook, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0CVE-2026-16723, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 Fastjson \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u043e\u043d\u0430 \u00ab\u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u043a\u0440\u0443\u0433 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0443\u0441\u043b\u0443\u0433, \u0437\u0434\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f, \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439, \u0440\u043e\u0437\u043d\u0438\u0447\u043d\u043e\u0439 \u0442\u043e\u0440\u0433\u043e\u0432\u043b\u0438, \u0431\u0438\u0437\u043d\u0435\u0441\u0430 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u0442\u0440\u0430\u0441\u043b\u044f\u0445\u00bb.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0447\u0442\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0431\u0430\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0421\u0428\u0410, \u043d\u0430\u0440\u044f\u0434\u0443 \u0441 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0430\u0442\u0430\u043a\u0430\u043c\u0438 \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u0438 \u041a\u0430\u043d\u0430\u0434\u0435, \u0445\u043e\u0442\u044f, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u044d\u0442\u0430 \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0442\u044c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043b\u043e\u0433\u0438\u043a\u043e\u0439 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0442\u0438\u043f\u043e\u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u043f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f AutoType. \u042d\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 Spring Boot \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c fat-JAR-\u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 type, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0442\u044c \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u0431\u0435\u0437 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 AutoType \u0438 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0446\u0435\u043f\u043e\u0447\u0435\u043a \u0433\u0430\u0434\u0436\u0435\u0442\u043e\u0432.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 Alibaba \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u00ab\u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u043e\u0439 \u043c\u043e\u0434\u0435\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Spring Boot\u00bb.\n\n\u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0443\u0441\u043b\u043e\u0432\u0438\u0435\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e, \u0447\u0442\u043e \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043e\u0431\u044a\u0435\u043a\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b Spring Boot fat-jar (\u0442.\u0435., \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b java -jar xxx.jar).\n\n\u041f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 CVE-2026-16723, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0432 \u043f\u043e\u043b\u044f \u00abObject\u00bb \u0438\u043b\u0438 \u00abMap\u00bb.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0442\u0438\u043f\u043e\u0432 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 fastjson2, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u043e\u0434\u0435\u043b\u044c \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u0442\u0438\u043f\u043e\u0432 \u0434\u043b\u044f \u043f\u043e\u043b\u0438\u043c\u043e\u0440\u0444\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u043d\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0430\u043d\u043d\u043e\u0442\u0430\u0446\u0438\u044e JSONType \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0438\u0433\u043d\u0430\u043b\u0430 \u0434\u043e\u0432\u0435\u0440\u0438\u044f.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432\u0435\u0440\u0441\u0438\u0438 FastJson 1.2.60 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043b\u044e\u0431\u044b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0444\u043e\u0440\u043c\u0430\u0442 fat-JAR, \u0442\u0430\u043a\u0436\u0435 \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u0432\u0435\u0440\u0441\u0438\u044e \u0438\u0437 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0433\u043e \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c (SafeMode) \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u0441\u0431\u043e\u0440\u043a\u0443, \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0443\u044e \u044d\u0442\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f CVE-2026-16723 \u043d\u0435 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043e. Imperva \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e FastJson 1.x \u0431\u043e\u043b\u044c\u0448\u0435 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043c\u0430\u043b\u043e\u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.", "creation_timestamp": "2026-07-29T00:00:32.197773Z"}, {"uuid": "7b12765b-36cc-49e4-a214-d5f2d255f5e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://t.me/HackerNewscyber/3292", "content": "\u2708\ufe0f \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 FortiOS \u0648 Fastjson \u0639\u0644\u06cc\u200c\u0628\u0627\u0628\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\n\n\ud83c\udfa5\u0641\u0648\u0631\u062a\u06cc\u0646\u062a \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 SSL-VPN \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 FortiOS \u062e\u0628\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0627 \u0627\u0631\u0633\u0627\u0644 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc HTTP \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc\u200c\u0634\u062f\u0647\u060c \u0648\u0635\u0644\u0647\u200c\u06cc \u0642\u0628\u0644\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645 symbolic link \u0631\u0627 \u062f\u0648\u0631 \u0628\u0632\u0646\u062f\u061b \u0627\u0644\u0628\u062a\u0647 \u067e\u06cc\u0634\u200c\u0634\u0631\u0637 \u0622\u0646\u060c \u0646\u0641\u0648\u0630 \u0642\u0628\u0644\u06cc \u0645\u0647\u0627\u062c\u0645 \u0628\u0647 \u0633\u0637\u062d \u0641\u0627\u06cc\u0644\u200c\u0633\u06cc\u0633\u062a\u0645 \u062f\u0633\u062a\u06af\u0627\u0647 \u0627\u0633\u062a. \u062c\u0632\u0626\u06cc\u0627\u062a \u0646\u062d\u0648\u0647 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0648 \u0639\u0627\u0645\u0644 \u062d\u0645\u0644\u0627\u062a \u0647\u0646\u0648\u0632 \u0645\u0634\u062e\u0635 \u0646\u06cc\u0633\u062a \u0648 \u0622\u0698\u0627\u0646\u0633\u200c\u0647\u0627\u06cc \u0641\u062f\u0631\u0627\u0644 \u0622\u0645\u0631\u06cc\u06a9\u0627 \u062a\u0627 \u06f1\u06f0 \u0627\u0648\u062a \u06f2\u06f0\u06f2\u06f6 \u0645\u0647\u0644\u062a \u062f\u0627\u0631\u0646\u062f \u0648\u0635\u0644\u0647 \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n\ud83c\udfa5\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u06cc\u06af\u0631\u060c CVE-2026-16723 \u0628\u0627 \u0627\u0645\u062a\u06cc\u0627\u0632 \u06f9.\u06f0 \u0627\u0632 \u06f1\u06f0\u060c \u062f\u0631 \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 Fastjson \u0639\u0644\u06cc\u200c\u0628\u0627\u0628\u0627 \u0627\u0633\u062a \u06a9\u0647 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062a\u0639\u0627\u0645\u0644 \u06a9\u0627\u0631\u0628\u0631 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0647\u0646\u0648\u0632 \u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647 \u0648 \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06f1.\u06f2.\u06f6\u06f8 \u062a\u0627 \u06f1.\u06f2.\u06f8\u06f3 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0641\u0648\u0631\u0627\u064b SafeMode \u0631\u0627 \u0641\u0639\u0627\u0644 \u06cc\u0627 \u0628\u0647 \u0646\u0633\u062e\u0647 \u0627\u0645\u0646 \u0645\u0647\u0627\u062c\u0631\u062a \u06a9\u0646\u0646\u062f.\n\n\n\u2708\ufe0f @HackerNewsCyber", "creation_timestamp": "2026-07-29T00:00:38.331592Z"}, {"uuid": "cc1b6f70-ac9c-4559-ae74-e86e3a5949da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/sy-gY02N2vY61unP8KTQmhG6Lrt3BtaNuULshxLDg-pvnZw", "content": "", "creation_timestamp": "2026-07-29T00:00:34.220254Z"}, {"uuid": "c71cf509-3f66-417b-a043-eaa5f2f0dbfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "Telegram/TTDc5m9rjxOF-FLNkY4srXBXmccnJEZ8Ua1WlC6sUt3lKgo", "content": "", "creation_timestamp": "2026-07-29T00:00:34.354938Z"}, {"uuid": "15fdc64f-0022-4d15-9a9b-9f66e09a620a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95452", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fastjson-rce-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a why-success\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 02:58:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFastjson 1.2.83 RCE \u9776\u573a\u73af\u5883 (CVE-2026-16723)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T00:00:48.190472Z"}, {"uuid": "dcb89928-0bef-4594-b5cb-35f33b16966f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mrr7hhz23sa5", "content": "\u30d1\u30c3\u30c1\u672a\u63d0\u4f9b\u306eFastjson\u306e\u8106\u5f31\u6027\u3001\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-16723\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/46925/", "creation_timestamp": "2026-07-29T05:38:07.503123Z"}, {"uuid": "a6773f15-ea11-4224-8748-1cbb12c0d4d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrrwqemfql2p", "content": "Discover the critical Fastjson RCE CVE-2026-16723 vulnerability. Learn how attackers exploit Spring Boot applications and find mitigation strategies.\n\n#Fastjson #CVE202616723 #Cybersecurity #SpringBoot #Malware", "creation_timestamp": "2026-07-29T12:34:20.866992Z"}, {"uuid": "3843ccea-0205-4f3a-b1a1-b6a29f4a2029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mrrx6k6tiu22", "content": "Fastjson RCE CVE-2026-16723:Spring Boot\u3092\u63fa\u308b\u304c\u3059\u91cd\u5927\u306a\u8106\u5f31\u6027\n\nFastjson\u30d0\u30fc\u30b8\u30e7\u30f31.2.83\u306f\u9577\u5e74\u306b\u308f\u305f\u308a\u3001\u3053\u306e\u30e9\u30a4\u30d6\u30e9\u30ea\u306e\u30ec\u30ac\u30b7\u30fc\u7cfb\u7d71\u306b\u304a\u3051\u308b\u5b89\u5168\u6027\u306e\u6700\u5f8c\u306e\u7826\u3068\u3055\u308c\u3066\u304d\u307e\u3057\u305f\u3002\u3057\u304b\u3057\u3001\u65b0\u305f\u306b\u767a\u898b\u3055\u308c\u305f\u8106\u5f31\u6027\u304c\u305d\u306e\u5b89\u5168\u795e\u8a71\u3092\u6253\u3061\u7815\u304d\u307e\u3057\u305f\u3002CVE-2026-16723(CVSS 9.0)\u3068\u547d\u540d\u3055\u308c\u305f\u3053\u306e\u91cd\u5927\u306a\u6b20\u9665\u306f\u3001\u653b\u6483\u8005\u304c\u8106\u5f31\u306aSpring Boo...", "creation_timestamp": "2026-07-29T12:42:16.687388Z"}, {"uuid": "1ca49bfa-e1dd-4381-b876-ade08d2e5df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mrsezgdb522c", "content": "\ud83d\udea8 Medium-severity security fix in undici@6.28.0, 7.29.0, and 8.9.0 just released!\n\nPatches CVE-2026-16729: cookie attribute injection via unsanitized domain and unparsed setCookie fields\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-07-29T16:49:58.333262Z"}, {"uuid": "bd2e66ff-bbda-4fca-a997-13561d4d5e4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mrsfhkitd62l", "content": "\ud83d\udea8 ACTIVE EXPLOITATION: A critical, unpatched RCE zero-day (CVE-2026-16723) in FastJson 1.x is being exploited in the wild. Affects versions 1.2.68-1.2.83. Users must migrate to FastJson2 or enable SafeMode now! #Java #ZeroDay #CyberAttack\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-29T16:57:51.636437Z"}, {"uuid": "0ae8f285-5d1e-4280-b69d-f76700c44f49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16723", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mrspzp6se32p", "content": "CVE-2026-16723: FastJson 1.x Under Active RCE Zero-Day Attack, Patch Unlikely", "creation_timestamp": "2026-07-29T20:06:57.754495Z"}, {"uuid": "446ceda1-d03f-4680-a3c1-69eed6a85068", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16728", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mrst4zfho22c", "content": "\ud83d\udea8 Medium-severity security fix in undici@6.28.0, 7.29.0, and 8.9.0 just released!\n\nPatches CVE-2026-16728: downstream response desynchronization via retry interceptor\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-07-29T21:02:32.069588Z"}]}