Attackers are targeting a critical Fastjson flaw in Spring Boot applications that can lead to unauthenticated code execution with Java process privileges, security firms said in July. The issue, tracked as CVE-2026-16723, affects Fastjson 1.2.68 through 1.2.83 and carries an Alibaba CVSS score of 9.0.
KEY FACTS
- Affected versions Fastjson 1.2.68 through 1.2.83
- Exposure Spring Boot executable fat-JAR deployments with a reachable JSON parser
- Mitigation Enable SafeMode or use the restricted 1.2.83_noneautotype build
- Status Alibaba had not released a fixed Fastjson 1.x version as of July 25
The advisory was published on July 21 after responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. The maintainers said the flaw requires no AutoType enablement and no classpath gadget, and that they verified the chain on Spring Boot 2.x, 3.x and 4.x with JDK 8, 11, 17 and 21.
Firsov’s technical analysis says the attack starts in Fastjson’s type-resolution path. A crafted @type value can trigger a class-resource lookup, and in a compatible Spring Boot fat-JAR, a nested JAR path can fetch attacker-controlled bytecode. The analysis also describes a newer-JDK path that uses a remote JAR through /proc/self/fd.
ThreatBook said on July 22 that its platform had captured in-the-wild exploitation after adding detection support two days earlier. Imperva reported activity against financial services, healthcare, computing, retail and other organizations, mainly in the United States, with smaller volumes in Singapore and Canada. Neither report gave attack counts, named victims or confirmed compromises.
Alibaba lists plain non-fat JARs, generic uber-JARs and Tomcat or Jetty WAR deployments as unaffected. It also says organizations that cannot migrate immediately should enable SafeMode with -Dfastjson.parser.safeMode=true or use com.alibaba:fastjson:1.2.83_noneautotype. Fastjson2 is listed as the long-term fix.
WHY IT MATTERS
The flaw affects a widely used Java library in a deployment model common in enterprise applications, which can widen exposure for organizations that embed Fastjson in Spring Boot fat-JARs. The available reports show active targeting, but they do not confirm a public breach or successful compromise of a named victim.