Threat reportVulnerabilityTL-2026-1752
Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated Remote Code Execution (Fastjson2 <= 2.0.62)
Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated (TL-2026-1752) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-29. It has no confirmed attribution, affects Alibaba fastjson2 (com.alibaba:fastjson2), maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1752
- Threat ID
- TL-2026-1752
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated
Malware and tooling: NSFOCUS WAF / IPS / Unified Threat Sensor
How Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated works
Fastjson2 versions <= 2.0.62 process the JSON @type field against a built-in AutoType whitelist even when SupportAutoType is not explicitly enabled, and that whitelist is verified only via FNV-1a hash comparison rather than actual class-name string validation. An unauthenticated attacker can craft a malicious JSON payload that satisfies the hash check while resolving an unintended class, achieving remote code execution without any third-party gadget chain. Fastjson2 releases above 2.0.62 are reported unaffected; no CVE has been assigned and no merged upstream patch exists as of 2026-07-29.
On 2026-07-29, NSFOCUS CERT published a critical (CVSS 9.8) vulnerability notice for Fastjson2, Alibaba's high-performance Java JSON library (com.alibaba:fastjson2), affecting all 2.x releases up to and including 2.0.62. Fastjson2 was designed to be secure-by-default relative to the legacy Fastjson 1.x branch: AutoType (automatic polymorphic deserialization triggered by an @type field) is disabled unless explicitly enabled by the application. This notice shows that design assumption does not fully hold — Fastjson2 still carries an internal AutoType whitelist that the deserializer consults even when SupportAutoType has not been turned on, and specific attacker-supplied @type values can pass that check.
The root cause, corroborated by the alibaba/fastjson2 hardening pull request #7695 (opened to address the issue and closed 2026-07-25 without being merged to main), is that the whitelist implementation (centered on ObjectReaderProvider.java, ContextAutoTypeBeforeHandler.java, and TypeUtils.java) accepted class names by comparing only a precomputed FNV-1a hash (acceptHashCodes) against the incoming type name's hash, without a secondary string-equality check against the actual registered class name (acceptNameSet). Because hash comparison alone cannot guarantee the input string is the exact intended class name, an attacker can supply a crafted @type value that satisfies the hash check for a whitelisted entry while the loader still resolves an unintended, attacker-influenced class reference. Unlike the classic Fastjson 1.x deserialization gadget chains (e.g. com.sun.rowset.JdbcRowSetImpl or TemplatesImpl chains, which require specific third-party classes on the target's classpath), this Fastjson2 issue requires no external gadget class — the built-in whitelist itself is the exploitation surface. PR #7695 additionally hardened against URL-special-character (':' and '!') smuggling in type names and applied ClassLoader/DataSource/RowSet blacklist checks consistently across both AutoType code paths, indicating the maintainers found more than one bypass primitive in the same subsystem.
The disclosure lands during a period of heightened scrutiny of the broader Fastjson ecosystem: on 2026-07-21, Alibaba published a separate advisory for CVE-2026-16723, a distinct, critical (CVSS 9.0) unauthenticated RCE in the legacy Fastjson 1.x branch (1.2.68-1.2.83), discovered by FearsOff Cybersecurity, which by 2026-07-25 was under confirmed active exploitation against Spring Boot fat-JAR deployments across financial services, healthcare, computing, and retail organizations in the US, Singapore, and Canada. CVE-2026-16723 and the Fastjson2 <= 2.0.62 whitelist bypass documented here are architecturally distinct (different branch, different bypass primitive, different code paths) and must not be conflated, but both share the same @type-driven trigger surface and the same primary mitigation (SafeMode), and their concurrent disclosure materially raises the likelihood that the Fastjson2 issue receives rapid weaponization attention once technical detail circulates further. A technical write-up on the Fastjson2 whitelist bypass by Chinese security firm 长亭 (Chuangyu/Longting), published via WeChat, is referenced in alibaba/fastjson2 GitHub issue #7702 (opened 2026-07-27), and third-party reproduction (gm7.org, 2026-07) reports the issue as reproduced with a working PoC/EXP, additionally identifying the unmerged hardening patch's commit hash as 6fc6f9502b68f7cb6057067217ea057d6a58b083. GitHub's own release tagging for fastjson2 shows the last vulnerable tagged release as 2.0.61, while the Maven Central artifact 2.0.62 (published 2026-05-05) is also confirmed vulnerable — a minor discrepancy between GitHub release tags and Maven publish versioning that defenders should account for when inventorying exposure.
Underscoring how closely watched the concurrent sibling disclosure became: ThreatBook, a threat-intelligence platform, added detection support for CVE-2026-16723 and captured in-the-wild exploitation traffic against it by 2026-07-22, one day after Alibaba's advisory; by contrast, CISA's public exploitation-status assessment for that same sibling CVE was still marked "none" as of 2026-07-23, an unexplained discrepancy between vendor telemetry and the federal tracker that illustrates the lag defenders should expect between vendor-observed exploitation and authoritative catalog updates — a dynamic directly relevant to monitoring this still-unassigned Fastjson2 issue for its own future KEV listing.
As of the NSFOCUS notice, no CVE identifier has been assigned to this Fastjson2 issue, it is absent from the CISA Known Exploited Vulnerabilities catalog, and no finalized upstream patched release has shipped (PR #7695 was closed unmerged). The only available mitigation is SafeMode, which fully disables AutoType and is configurable via code (ParserConfig.getGlobalInstance().setSafeMode(true)), a JVM flag (-Dfastjson.parser.safeMode=true), or a classpath properties file (fastjson.parser.safeMode=true). NSFOCUS additionally recommends WAF rules that inspect inbound JSON bodies for an @type field, including encoded/obfuscated variants, as an interim compensating control.
MITRE ATT&CK techniques used in TL-2026-1752
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1046 Network Service Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Impact
Persistence
T1505 Server Software Component
Resource Development
T1588.005 Exploits; T1588.006 Vulnerabilities
Reconnaissance
Affected products and versions in Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated
- Alibaba — fastjson2 (com.alibaba:fastjson2)
Vulnerable versions: Fastjson2 2.x, all releases <= 2.0.62
Fixed in: Fastjson2 2.x releases > 2.0.62 (per vendor guidance; no independently confirmed fixed release version at time of notice)
Remediation for Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated
Patches
- No finalized, merged upstream patch exists as of 2026-07-29; GitHub PR #7695 (AutoType class-name and whitelist-text validation hardening across ObjectReaderProvider.java, ContextAutoTypeBeforeHandler.java, TypeUtils.java, and AutoTypeValidationTest.java) was closed 2026-07-25 without being merged to the main branch
- Vendor guidance states Fastjson2 releases above 2.0.62 are not affected, though the exact commit/release that introduced the fix is not confirmed in public release notes as of this notice
Immediate actions
- Enable SafeMode in code: ParserConfig.getGlobalInstance().setSafeMode(true);
- Enable SafeMode via JVM flag: -Dfastjson.parser.safeMode=true
- Enable SafeMode via classpath properties file: fastjson.parser.safeMode=true
- Deploy WAF rules to inspect and block/alert on inbound JSON request bodies containing an '@type' field, including URL-encoded or otherwise obfuscated variants
Workarounds
- SafeMode configuration (code, JVM flag, or properties file) fully disables AutoType and eliminates this deserialization class entirely
- Perimeter/WAF filtering of the '@type' field in inbound JSON bodies as an interim compensating control pending an official patch
Longer-term hardening
- Upgrade com.alibaba:fastjson2 to a release newer than 2.0.62 once an official patched version is formally published and independently verified
- Inventory all services embedding fastjson2 (classpath/JAR scanning, e.g. lsof | grep fastjson, or SBOM/dependency scanning) to confirm exposure across the estate
- Where AutoType functionality is genuinely required, restrict it via ContextAutoTypeBeforeHandler bound to an explicit, application-defined class allowlist rather than relying on the library's built-in whitelist
- Track alibaba/fastjson2 GitHub issue #7702 and pull request #7695 for the finalized upstream fix and eventual official CVE assignment
Weaknesses (CWE) in Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated
Timeline of Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated
- Fastjson2 version 2.0.62 — the final release in the vulnerable range — is published to Maven Central.
- Alibaba/Fastjson maintainers publish a security advisory for the related but architecturally distinct CVE-2026-16723, a critical RCE in the separate Fastjson 1.x branch (1.2.68-1.2.83) discovered by FearsOff Cybersecurity, sharply raising scrutiny of the broader Fastjson ecosystem.
- Threat-intelligence platform ThreatBook adds detection support for the sibling CVE-2026-16723 and captures in-the-wild exploitation traffic against it, one day after Alibaba's advisory — the earliest confirmed observation of active exploitation in the Fastjson ecosystem during this disclosure window.
- CISA's public exploitation-status assessment for sibling CVE-2026-16723 remains marked 'none,' diverging from ThreatBook's and Imperva's vendor-observed in-the-wild exploitation telemetry — a tracking-lag data point relevant to monitoring this still-unassigned Fastjson2 issue for its own eventual KEV listing.
- GitHub pull request #7695 on alibaba/fastjson2, which hardens AutoType class-name and whitelist-text validation across ObjectReaderProvider.java, ContextAutoTypeBeforeHandler.java, and TypeUtils.java, is closed without being merged to the main branch.
- Active in-the-wild exploitation of CVE-2026-16723 against Fastjson 1.x Spring Boot fat-JAR deployments is confirmed (Imperva/SecurityWeek reporting), targeting financial services, healthcare, computing, and retail organizations across the US, Singapore, and Canada.
- GitHub issue #7702 is opened on alibaba/fastjson2 requesting a timeline for an official patched release addressing the 2.x AutoType whitelist bypass, referencing a technical write-up by Chinese security firm 长亭 (Chuangyu/Longting) circulated via WeChat.
- As of the NSFOCUS notice's publication, no CVE identifier has been assigned to the Fastjson2 <= 2.0.62 AutoType whitelist-bypass issue, it is absent from the CISA Known Exploited Vulnerabilities catalog, and no finalized upstream patch has been merged.
- NSFOCUS CERT publishes the 'Fastjson 2.x Remote Code Execution Vulnerability Notice,' assigning CVSS 9.8, confirming Fastjson2 versions <= 2.0.62 remain vulnerable via built-in AutoType whitelist processing even when SupportAutoType is disabled, and recommending SafeMode as the primary mitigation pending an official patch.
Sources cited for Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated
- Fastjson 2.x Remote Code Execution Vulnerability Notice
- alibaba/fastjson2 issue #7702 — patched release timeline / AutoType whitelist bypass discussion
- alibaba/fastjson2 pull request #7695 — AutoType validation and whitelist hardening (closed unmerged)
- 【已复现】Fastjson2 远程代码执行漏洞 (Fastjson2 RCE reproduction analysis)
- How the Fastjson RCE Vulnerability Actually Works, and How to Check You're Exposed
- Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available
- Imperva Customers Protected Against CVE-2026-16723: Critical FastJson 1.x Zero-Day RCE
- CVE-2026-16723
- alibaba/fastjson2 — upstream repository
- 长亭 (Chuangyu/Longting) WeChat technical write-up on the Fastjson2 AutoType whitelist bypass (cited in GitHub issue #7702)
- Fastjson 1.2.x Remote Code Execution Without Gadget Vulnerability Notice
Detection coverage for TL-2026-1752
As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1752 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.