Hackers Hit Unpatched Fastjson Bug in Spring Boot Apps, No Fix Yet
CVE-2026-16723 lets attackers run code on vulnerable Java servers without a password. Alibaba scores it 9.0. No patch is available.
Key points
- Attackers are exploiting CVE-2026-16723, a critical flaw in Fastjson, Alibaba's JSON library for Java applications.
- The bug lets a crafted web request run code on the server with no login required, rated 9.0 out of 10 by Alibaba.
- ThreatBook and Imperva confirm the attacks target Spring Boot apps, a widely used Java web framework.
- No official patch is available.
- Any organisation running Fastjson 1.x behind a Java web app should assume it's a target.
Security researchers say criminals are actively attacking a serious flaw in Fastjson, a library from Alibaba that Java applications use to read and write JSON data (the plain-text format apps use to pass information between services).
The bug is tracked as CVE-2026-16723. Alibaba rates it 9.0 out of 10 on the standard severity scale. There's no patch yet. We first covered Alibaba's exposure to unpatched flaws in our 10 July story on the XQUIC HTTP/3 crash bug; this one is considerably more dangerous.
What does the bug actually let attackers do?
It lets an unauthenticated attacker run their own code on a vulnerable server. Someone on the internet sends a booby-trapped web request to a site using Fastjson, and the server executes whatever commands the attacker chose, without asking who they are.
The code runs with the same permissions as the Java process handling the request. On many servers, that's enough to read files or install malware, and pivot deeper into the network.
ThreatBook and Imperva confirm the attack chain targets Spring Boot applications. Spring Boot is the framework developers reach for first when building Java web services, so the pool of potential victims is wide.
Who is affected?
Anyone running Fastjson 1.x inside a Java web application that accepts JSON from users. That covers APIs and internal tools built over the last decade.
Fastjson's 1.x branch has been patched repeatedly for deserialization flaws, where the library is tricked into building dangerous objects from attacker-supplied data. Alibaba shipped Fastjson 2 partly to close that chapter. Teams that didn't migrate are exposed again.
| Detail | Value |
|---|---|
| CVE ID | CVE-2026-16723 |
| CVSS score | 9.0 (Alibaba-assigned) |
| Affected software | Fastjson 1.x in Spring Boot apps |
| Authentication needed | None |
| Patch available | No |
| Reported by | ThreatBook, Imperva |
What should defenders do right now?
Assume exploitation and act. With no vendor fix, the options are containment and detection, first reported by The Hacker News as an active-exploitation story.
Inventory first. Find every service using Fastjson 1.x. Java build files (pom.xml for Maven, build.gradle for Gradle) list it as a dependency, but don't trust memory: dependencies pull in other dependencies, and Fastjson often arrives that way.
For exposed services, put a web application firewall rule in front of any endpoint that parses JSON. Log payloads containing the @type field, which Fastjson exploitation historically abuses to force the library to build attacker-chosen Java classes. Block outbound traffic from application servers to anything they don't need to reach, cutting off the step where a server fetches a malicious payload from an attacker-controlled host.
Migration to Fastjson 2 is the durable fix. It's not a drop-in replacement, but it removes an entire category of risk the 1.x line has never shaken.
Does this affect ordinary people?
Not directly, but indirectly yes. If a company you use runs a vulnerable Java service, attackers could reach customer data behind it. There's nothing for a home user to patch. Watch for breach notifications from services you use, and treat unexpected password-reset emails in the coming weeks with caution: go to the site directly rather than clicking the email.
