“Tracked as CVE-2026-16723,” Alibaba assigns the flaw a 9.0 CVSS score — and security firms now say attackers are actively probing the exposed path in Fastjson 1.x used in many Spring Boot deployments.
CVE-2026-16723: the Fastjson 1.x chain in plain terms
The confirmed exploit chain requires four specific conditions: Fastjson versions 1.2.68 through 1.2.83; a Spring Boot executable fat‑JAR; a network‑reachable endpoint that feeds attacker‑controlled JSON into an affected parser; and Fastjson SafeMode left at its disabled default. Alibaba’s maintainers and the public analysis emphasize two surprising technical facts: AutoType can remain disabled, and no classpath gadget is required. The vulnerability was assigned CVE-2026-16723 and given an Alibaba‑assigned CVSS score of 9.0.
Attackers can reach parsing entry points such as JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Binding incoming JSON to a fixed class does not necessarily block the chain if the bound class contains Object or Map fields where a nested payload can appear. Fastjson2 is not affected because it does not use the same resource‑probing or annotation‑based trust path.
Kirill Firsov’s disclosure and Alibaba’s advisory
Alibaba published an advisory on July 21 following responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. Firsov traced the weakness to Fastjson’s type‑resolution path: a malicious @type value can be interpreted as a class‑resource lookup. In a Spring Boot fat‑JAR, a crafted nested JAR path can fetch attacker‑controlled bytecode; an embedded @JSONType annotation in that resource can be treated as a trust signal, allowing Fastjson to load the class. His analysis also describes a newer‑JDK variant that downloads a remote JAR and references it via /proc/self/fd.
Alibaba’s maintainers verified the chain on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21. As of July 25, Alibaba had not released a fixed Fastjson 1.x version. The project recommends migration to Fastjson2 as the long‑term fix; organizations that cannot migrate immediately are told to enable SafeMode with -Dfastjson.parser.safeMode=true or to use the restricted build com.alibaba:fastjson:1.2.83_noneautotype.
ThreatBook and Imperva: observed exploitation patterns
Security firms reported in‑the‑wild activity after rapid detection updates. ThreatBook said its platform captured exploitation after adding detection support two days earlier; its lab work reproduced full code execution in a Spring Boot fat‑JAR on JDK 8, while an embedded Tomcat test produced a remote JAR fetch or server‑side request forgery. Imperva reported activity against financial services, healthcare, computing, retail, and other organizations, primarily in the United States with smaller volumes in Singapore and Canada. Imperva added that browser impersonators generated most requests, while Ruby and Go tools represented about 30% of observed tooling collectively.
Neither vendor published attack counts, raw request logs, execution evidence, named victims, or confirmed compromises; both framed their publications as establishing observed exploit activity rather than proving successful code execution or breach. A July 23 CISA‑ADP assessment nevertheless marked exploitation as none. The Hacker News confirmed on July 25 that the flaw was not listed in CISA’s current Known Exploited Vulnerabilities catalog; the available sources do not explain that mismatch.
What Spring Boot operators and security teams should inspect
The immediate operational advice in the record is specific. Organizations should inventory direct and transitive Fastjson dependencies and identify Spring Boot executable fat‑JAR deployments. Alibaba and independent analysts point to concrete detection markers: suspicious @type values in JSON payloads, nested JAR URLs in parsed types, unexpected outbound connections (notably remote JAR fetches), creation of child processes, unexplained file changes, and web shells. The advisory also notes that plain non‑fat JARs, generic uber‑JARs, and Tomcat or Jetty WAR deployments are not affected by this chain because the exploit depends on the Spring Boot executable fat‑JAR loader.
What financial services, healthcare, and retail organizations should watch
Imperva identified financial services, healthcare, computing, and retail among the sectors receiving most of the observed traffic, primarily in the United States with smaller volumes in Singapore and Canada. These organizations should prioritize inventorying Fastjson usage and verifying SafeMode settings or deploying the restricted 1.2.83_noneautotype build where immediate migration is impractical. Given Imperva’s note that browser impersonators generated most requests and that Ruby and Go tools account for roughly 30% of observed tooling, incident responders should correlate web request patterns with the parsing entry points named in the advisory.
The recorded facts leave two practical takeaways. First, there is an exploit chain that can be reproduced under the listed conditions; ThreatBook and Imperva observed related activity in the wild. Second, as of July 25 there was no Fastjson 1.x patch released, and Alibaba’s recommended long‑term remedy is migration to Fastjson2 while organizations use SafeMode or the noneautotype build as immediate mitigations. The Hacker News has reached out to Alibaba and Imperva for clarification and will update the story with any response.
