Alibaba Fastjson versions prior to 1.2.48 mishandle the autoType feature, allowing an attacker to craft JSON input with an @type key that names a Java class. This can trigger calls to public methods of that class, which depending on their behavior, may lead to JNDI injection attacks using attacker-supplied payloads embedded elsewhere in the JSON document. This vulnerability stems from an incomplete fix of CVE-2017-18349 and has been exploited in the wild from 2023 to 2025. The CVSS 3.1 base score is 10.0 (critical), reflecting network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. The Red Hat advisory linked does not explicitly mention patch availability in the provided content, so patch status is not confirmed here.

Successful exploitation can lead to remote code execution via JNDI injection, resulting in full compromise of affected systems. The vulnerability affects confidentiality, integrity, and availability with critical severity. It has been exploited in the wild, indicating active threat. Systems using vulnerable Fastjson versions are at high risk of compromise.

Patch status is not explicitly confirmed in the provided vendor advisory content. Users should check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-70974 for the latest remediation guidance. Upgrading Fastjson to version 1.2.48 or later is expected to address the issue, as the vulnerability affects versions before 1.2.48. Until patched, avoid processing untrusted JSON input with autoType enabled or disable autoType functionality if possible.