Threats affecting pkg:pypi/pyfory

Apache Fory versions before 1.0.0 contain a critical deserialization vulnerability (CWE-502) in the PyFory ReduceSerializer. This vulnerability allows bypassing of DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution when using Python-native mode with strict mode disabled. Exploitation requires deserializing attacker-controlled data under these conditions. Upgrading to Apache Fory 1.0.0 or later mitigates the issue by enforcing DeserializationPolicy validation.