Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.
Tracked as CVE-2026-16723
, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that sends attacker-controlled JSON to an affected parser, and SafeMode left at its disabled default. AutoType can remain disabled, and no classpath gadget is required.
As of July 25, Alibaba had not released a fixed Fastjson 1.x version. Organizations that cannot migrate immediately should enable SafeMode with -Dfastjson.parser.safeMode=true
or use com.alibaba:fastjson:1.2.83_noneautotype
. Alibaba lists migration to Fastjson2 as the long-term fix.
Alibaba published its advisory on July 21 following responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. The maintainers described the vulnerability as requiring "no AutoType enablement" and "no classpath gadget." They verified the chain on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21.
Firsov traced the issue to Fastjson's type-resolution path. An attacker-controlled @type
value can be turned into a class-resource lookup. In a compatible Spring Boot fat-JAR, a crafted nested JAR path can fetch attacker-controlled bytecode. An @JSONType
annotation in that resource can then be treated as a trust signal, allowing the class to pass Fastjson's type checks and load.
His technical analysis also describes a newer-JDK path that downloads a remote JAR and references it through /proc/self/fd
.
The exploit depends on the Spring Boot executable fat-JAR loader. Alibaba lists plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments as unaffected. Reachable entry points include JSON.parse
, JSON.parseObject(String)
, and JSON.parseObject(String, Class)
. Binding input to a fixed class is not sufficient when an object contains an Object
or Map
field where the payload can be nested.
ThreatBook said on July 22 that its platform had captured in-the-wild exploitation after adding detection support two days earlier. Its laboratory results were narrower: it reproduced full code execution in a Spring Boot fat-JAR on JDK 8, while its embedded Tomcat test produced only a remote JAR fetch or server-side request forgery.
Imperva reported activity against financial services, healthcare, computing, retail, and other organizations, primarily in the United States, with smaller volumes in Singapore and Canada. It said browser impersonators generated most requests, while Ruby and Go tools represented about 30% collectively.
Neither vendor published attack counts, raw requests, execution evidence, named victims, or confirmed compromises. Their reports establish observed exploit activity, not proof of successful code execution against a real-world target or a breach.
A July 23 CISA-ADP assessment nevertheless marked exploitation as none
. The Hacker News confirmed on July 25 that the flaw was absent from CISA's current Known Exploited Vulnerabilities catalog. The available sources do not explain the mismatch.
The Hacker News also found no patched Fastjson 1.x artifact in the project's GitHub tags or Maven Central repository as of July 25. Version 1.2.83 remains the latest standard 1.x release, while 1.2.83_noneautotype
remains the available restricted build.
Organizations should inventory direct and transitive Fastjson dependencies and inspect affected systems for suspicious @type
values, nested JAR URLs, unexpected outbound connections, child processes, file changes, and web shells. Fastjson2 is not affected because it does not use the same resource-probing or annotation-based trust path.
The Hacker News has reached out to Alibaba for clarification on the affected versions and Fastjson 1.x patch plans, and to Imperva for details about the reported exploitation activity. We will update the story with any response.
Fastjson 1.2.83 was Alibaba's recommended upgrade for a separate AutoType bypass disclosed in 2022. That final 1.x release now sits inside the affected range for CVE-2026-16723
.
Facts Only
* ThreatBook and Imperva identify a vulnerability in Fastjson, Alibaba's JSON library for Java.
* The vulnerability allows code execution in affected Spring Boot applications via malicious JSON requests without authentication.
* The issue is tracked as CVE-2026-16723 with an Alibaba CVSS score of 9.0.
* Exploitation requires Fastjson versions between 1.2.68 and 1.2.83, a Spring Boot executable fat-JAR, and network-reachable path delivery.
* The exploit chain involves an attacker-controlled `@type` value being transformed into a class-resource lookup to fetch bytecode.
* Exploitation targets specific methods like `JSON.parse`, `JSON.parseObject(String)`, and `JSON.parseObject(String, Class)`.
* Plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments are listed as unaffected.
* The CISA-ADP assessment marked exploitation as none on July 23.
* Fastjson2 is not affected by this vulnerability as it uses a different trust path.
Executive Summary
Full Take
Sentinel — Human
This text reads like a synthesized security briefing compiled from multiple official reports and investigative journalism pieces, demonstrating a high degree of informational integration.