Fastjson 1.x unauthenticated RCE in Spring Boot applications
Unauthenticated remote code execution in Alibaba's Fastjson 1.x JSON library via crafted JSON in Spring Boot apps. CVSS 9.0 (Alibaba-assigned). No patch available. Active exploitation confirmed by ThreatBook and Imperva.
- Vendor
- Alibaba
- Product
- Fastjson 1.x (Spring Boot applications)
- CVSS
- 9.0
- EPSS (exploit probability)
- N/A
- Status
- exploited-in-wild
- Published
Unauthenticated remote code execution in Alibaba’s Fastjson 1.x JSON parsing library. Exploitation requires only that the application accept untrusted JSON input — no authentication, no user interaction.
Affected scope. Spring Boot applications running Fastjson 1.x that process JSON from untrusted sources (public API endpoints, user-submitted data, webhook handlers). A specially crafted JSON request triggers code execution with the privileges of the Java process.
Exploitation status. Active. ThreatBook and Imperva reported confirmed attack activity on July 25, 2026. Attribution: unconfirmed — treat accordingly. Not yet listed on CISA KEV at time of writing.
Patch status. None. Alibaba has not released a fix for the 1.x branch. No timeline is published.
Mitigation. Restrict or eliminate untrusted JSON deserialization at the application boundary. Consider migrating off Fastjson 1.x — the 1.x branch has a long history of deserialization vulnerabilities; Fastjson2, Jackson, and Gson are common alternatives.
Sources. NVD CVE-2026-16723 · The Hacker News, July 25, 2026
