What’s Vulnerable › Vulnerabilities

CVE-2022-25845: Deserialization of Untrusted Data

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-10 · updated 2026-06-17
• Weakness: CWE-502

Description

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Affected products

• Alibaba Fastjson: before 1.2.83 — fixed in 1.2.83
• Oracle Communications Cloud Native Core Unified Data Repository: 22.2.0

How to fix

Upgrade to a fixed version: Alibaba Fastjson 1.2.83. Check the vendor advisory for mitigations.

References

• https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d
• https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15
• https://github.com/alibaba/fastjson/releases/tag/1.2.83
• https://github.com/alibaba/fastjson/wiki/security_update_20220523
• https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222
• https://www.ddosi.org/fastjson-poc/
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d
• https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15
• https://github.com/alibaba/fastjson/releases/tag/1.2.83
• https://github.com/alibaba/fastjson/wiki/security_update_20220523
• https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222

Get alerted when CVE-2022-25845 or the next vulnerability affects your stack