Apache Fory versions prior to 1.0.0 contain a CWE-502 deserialization vulnerability in the PyFory ReduceSerializer. This serializer could bypass the intended DeserializationPolicy validation during the restoration of reduce-state and global-name resolution, allowing potentially unsafe classes, functions, or module attributes to be deserialized if strict mode is disabled and the application relies on DeserializationPolicy for security. The vulnerability is addressed in version 1.0.0 by enforcing validation in the affected ReduceSerializer code paths.

An application using Apache Fory before version 1.0.0 that deserializes attacker-controlled data in Python-native mode with strict mode disabled and relies on DeserializationPolicy for restricting unsafe deserialization is vulnerable. This could lead to the execution of unsafe or malicious code during deserialization. No known exploits in the wild have been reported as of the published date.

Users should upgrade Apache Fory to version 1.0.0 or later, where the DeserializationPolicy validation is enforced for the ReduceSerializer, effectively fixing this vulnerability. No other mitigation or temporary workaround is indicated in the advisory.