CVE-2025-59328: Apache Fory Deserialization of Untrusted Data vulnerability

The vulnerability in Apache Fory (CVE-2025-59328) is a Denial of Service (DoS) caused by the insecure deserialization of untrusted data. An attacker can provide a specially crafted, deeply nested object graph. When the Fory library attempts to deserialize this data, it enters a deep recursion without any limits on the nesting depth. This leads to excessive CPU and memory consumption, ultimately causing the application to become unresponsive.

The security patch mitigates this by introducing a configurable maximum deserialization depth (maxDepth), which defaults to 50. The core deserialization logic was updated to track the current depth and throw an InsecureException if this limit is exceeded, thus preventing the DoS attack.

The identified vulnerable functions are the key methods involved in the recursive deserialization process for different data types (general objects, collections, maps). Before the patch, these functions lacked the necessary depth checks. The provided patch evidence clearly shows the addition of the incReadDepth() call, which contains the new security check, directly within these functions or their closely-related helpers. Any deserialization operation that involves nested data structures would pass through these functions, making them the focal point of the vulnerability.