Skip to content
#

remote-class-loading

Star

Here is 1 public repository matching this topic...

dinosn / fastjson-jsontype-rce-lab

Star 191

Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @jsontype resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@jsontype(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.

security spring-boot deserialization poc rce vulnerability appsec fastjson ssrf autotype jsonsubtypes security-lab fastjson2 jsontype remote-class-loading
  • Updated Jul 27, 2026
  • Python

Improve this page

Add a description, image, and links to the remote-class-loading topic page so that developers can more easily learn about it.

Curate this topic

Add this topic to your repo

To associate your repository with the remote-class-loading topic, visit your repo's landing page and select "manage topics."

Learn more