Review reviewCritical

CVE-2025-70974

Alibaba Fastjson, OpenShift Service Mesh 2, Red Hat build of Apache Camel for Spring Boot 4

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

CVSS: 10
EPSS: 0.69%
CISA KEV: Not listed
Published: 2026.01.09

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.69%

Technical severityCVSS 10

Vulnerability overview

Affected product and versions

Product: Alibaba Fastjson, OpenShift Service Mesh 2, Red Hat build of Apache Camel for Spring Boot 4
Affected versions: < 1.2.48
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Alibaba Fastjson, OpenShift Service Mesh 2, Red Hat build of Apache Camel for Spring Boot 4 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-829