{"id":"CVE-2025-70974","aliases":["EUVD-2026-1694","GHSA-jm7w-5684-pvh8"],"status":"published","title":"FASTJSON Includes Functionality from Untrusted Control Sphere","description":"Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00746,"percentile":0.5511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-829"],"published":"2026-01-09T06:43:23Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"Maven","package":"com.alibaba:fastjson","fixed_in":["1.2.48"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.alibaba:fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.48"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.alibaba:fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.48"}]}],"versions":["1.1.15","1.1.16","1.1.17","1.1.18","1.1.19","1.1.20","1.1.21","1.1.22","1.1.23","1.1.24","1.1.25","1.1.26","1.1.27","1.1.28","1.1.29","1.1.30","1.1.31","1.1.31.sec01","1.1.31.sec04","1.1.31.sec06","1.1.31.sec07","1.1.31.sec10","1.1.31_noneautotype","1.1.32","1.1.33","1.1.33.android","1.1.33.sec01","1.1.33.sec04","1.1.33.sec06","1.1.33.sec10","1.1.34","1.1.34.android","1.1.34.sec01","1.1.34.sec04","1.1.34.sec06","1.1.34.sec09","1.1.34.sec10","1.1.34_noneautotype","1.1.35","1.1.36","1.1.37","1.1.38","1.1.39","1.1.40","1.1.41","1.1.41.sec01","1.1.41.sec04","1.1.41.sec06","1.1.41.sec10","1.1.42","1.1.42.android","1.1.43","1.1.43.android","1.1.44","1.1.44.android","1.1.45","1.1.45.android","1.1.46","1.1.46.android","1.1.46.sec01","1.1.46.sec04","1.1.46.sec06","1.1.46.sec09","1.1.46.sec10","1.1.46_noneautotype","1.1.47.android","1.1.48.android","1.1.49.android","1.1.50.android","1.1.51.android","1.1.52.android","1.1.53.android","1.1.54.android","1.1.55.android","1.1.56.android","1.1.57.android","1.1.58.android","1.1.59.android","1.1.60.android","1.1.61.android","1.1.62.android","1.1.63.android","1.1.64.android","1.1.65.android","1.1.66.android","1.1.67.android","1.1.68.android","1.1.69.android","1.1.70.android","1.1.70.android_noneautotype","1.1.71.android","1.1.72.android","1.1.73.android","1.1.76.android","1.1.76.android_noneautotype","1.1.77.android_noneautotype","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.13.sec01","1.2.14","1.2.14.sec01","1.2.14.sec10","1.2.15","1.2.16","1.2.16.sec01","1.2.16.sec04","1.2.16.sec10","1.2.17","1.2.18","1.2.19","1.2.2","1.2.2.sec01","1.2.2.sec10","1.2.20","1.2.21","1.2.22","1.2.23","1.2.24","1.2.25","1.2.25.sec10","1.2.26","1.2.27","1.2.27.sec06","1.2.27.sec09","1.2.27.sec10","1.2.28","1.2.28.odps","1.2.29","1.2.29.sec04","1.2.29.sec06","1.2.29.sec09","1.2.29.sec10","1.2.3","1.2.30","1.2.31","1.2.31.sec10","1.2.31_noneautotype","1.2.32","1.2.33","1.2.34","1.2.35","1.2.36","1.2.37","1.2.38","1.2.39","1.2.4","1.2.4.sec01","1.2.4.sec04","1.2.4.sec09","1.2.4.sec10","1.2.40","1.2.41","1.2.42","1.2.43","1.2.44","1.2.45","1.2.46","1.2.47","1.2.5","1.2.6","1.2.7","1.2.7.sec01","1.2.7.sec04","1.2.7.sec06","1.2.7.sec09","1.2.7.sec10","1.2.8","1.2.8.sec01","1.2.8.sec04","1.2.8.sec05","1.2.8.sec06","1.2.8.sec09","1.2.8.sec10","1.2.8.sec10_noneautotype","1.2.8_noneautotype","1.2.9"]}],"products":[{"vendor":"alibaba","product":"fastjson"},{"vendor":"red hat","product":"openshift service mesh 2"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of debezium 2"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"}],"references":[{"url":"https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48","tags":["web"]},{"url":"https://www.seebug.org/vuldb/ssvid-98020","tags":["web"]},{"url":"https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238","tags":["web"]},{"url":"https://www.freebuf.com/vuls/208339.html","tags":["web"]},{"url":"https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce","tags":["web"]},{"url":"https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger","tags":["article","web"]},{"url":"https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-70974","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428203","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-70974.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70974","tags":["advisory"]},{"url":"https://web.archive.org/web/20220121055754/https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jm7w-5684-pvh8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70974.json","tags":["advisory"]},{"url":"https://github.com/alibaba/fastjson","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-70974","description":"Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","status":"published","published":"2026-01-09T06:43:23.584Z","modified":"2026-07-15T11:47:44.676Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-829","CWE-829"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2026-1694","description":"Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","status":"published","published":"2026-01-09T06:43:23Z","modified":"2026-07-15T11:47:44Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:53.678292Z"}],"ghsa":[{"id":"GHSA-jm7w-5684-pvh8","title":"FASTJSON Includes Functionality from Untrusted Control Sphere ","description":"Fastjson before 1.2.48 mishandles autoType because, when an `@type` key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","status":"published","published":"2026-01-09T09:31:19Z","modified":"2026-10-05T18:38:46Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2025-70974","description":"Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","status":"published","published":"2026-01-09T07:16:02.677Z","modified":"2026-07-15T02:17:53.7Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-70974","description":"Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","status":"published","published":"2026-01-09T06:43:23.584Z","modified":"2026-10-28T02:30:50.608090647Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"GHSA-jm7w-5684-pvh8","title":"FASTJSON Includes Functionality from Untrusted Control Sphere ","description":"Fastjson before 1.2.48 mishandles autoType because, when an `@type` key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.","status":"published","published":"2026-01-09T09:31:19Z","modified":"2026-10-05T18:45:05.985873086Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}