Full Report
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires
Analysis Summary
# Vulnerability: Fastjson 1.x Remote Code Execution (RCE) via Spring Boot Fat-JARs
## CVE Details
- **CVE ID:** CVE-2026-16723
- **CVSS Score:** 9.0 (Critical) - Alibaba assigned
- **CWE:** Type Confusion / Deserialization of Untrusted Data
## Affected Systems
- **Products:** Alibaba Fastjson (1.x branch)
- **Versions:** 1.2.68 through 1.2.83
- **Configurations:**
- Applications must be deployed as a **Spring Boot executable fat-JAR**.
- `SafeMode` must be disabled (default state).
- Network-reachable path that accepts attacker-controlled JSON input.
- Specifically affects environment running JDK 8, 11, 17, or 21.
## Vulnerability Description
The flaw resides in Fastjson's type-resolution path. An attacker can use a crafted `@type` value in a JSON request to trigger a class-resource lookup. In the context of a Spring Boot fat-JAR, this mechanism can be abused to fetch attacker-controlled bytecode from a nested JAR path. Because an `@JSONType` annotation in that resource is treated as a "trust signal," the class bypasses Fastjson's security checks (even with `AutoType` disabled) and is loaded into the Java process, leading to Remote Code Execution (RCE).
## Exploitation
- **Status:** **Exploited in the wild.** Active targeting observed by ThreatBook and Imperva against financial, healthcare, and retail sectors.
- **Complexity:** Low - Does not require `AutoType` to be enabled or the presence of common "gadget" classes on the classpath.
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Full access to the Java process memory and data)
- **Integrity:** High (Execution of arbitrary code with process privileges)
- **Availability:** High (Potential for system takeover or service disruption)
## Remediation
### Patches
- **No official patch currently available** for the Fastjson 1.x branch as of July 25, 2026.
- **Long-term Fix:** Migrate to **Fastjson2**, which is not affected by this resource-probing trust path.
### Workarounds
- **Enable SafeMode:** Run the application with the JVM argument: `-Dfastjson.parser.safeMode=true`.
- **Restricted Build:** Use the specific version `com.alibaba:fastjson:1.2.83_noneautotype`.
## Detection
- **Indicators of Compromise:**
- JSON payloads containing suspicious `@type` keys.
- Nested JAR URLs (e.g., `jar:file:...!.jar`) within JSON requests.
- Unexpected outbound connections from the Java process to unknown IP addresses.
- Unusual child processes or the appearance of web shells in application directories.
- **Detection methods:** Inspect logs for reachable entry points such as `JSON.parse` and `JSON.parseObject`. Monitor for `/proc/self/fd` references on newer JDKs.
## References
- **Vendor Advisory:** hxxps://github[.]com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83
- **Technical Analysis:** hxxps://fearsoff[.]org/research/fastjson-1-2-83-rce
- **Threat Intelligence:** hxxps://threatbook[.]io/blog/fastjson-rce-1.2.83-active-exploitation-detected-detection-mitigation
- **Security Report:** hxxps://www[.]imperva[.]com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/