10.0
Critical
CVE-2025-70974 Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key…
Description
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fastjson 1.2 | earliest → < 1.2.48 | 1.2.48 |
| OpenShift Service Mesh 2 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat build of Debezium 2 | Versions not published | |
| Red Hat build of Debezium 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published |
References
- github.com github.com
- www.seebug.org www.seebug.org
- www.cnvd.org.cn www.cnvd.org.cn
- www.freebuf.com www.freebuf.com
- github.com github.com
- www.cloudsek.com www.cloudsek.com
- cert.360.cn cert.360.cn
Timeline
- Published
- Last modified