CVE-2026-16723
Fixed in a distro release EPSS <1%CVSS 9.0
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Products: Alibaba Fastjson
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.alibaba:fastjson | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | seata-server | 2.7.0-r4 |