[GHSA-crf3-v9rr-v7hj] Fix package mapping for CVE-2026-16723 Fastjson2 RCE

advisories/unreviewed/2026/07/GHSA-crf3-v9rr-v7hj/GHSA-crf3-v9rr-v7hj.json

@@ -1,36 +1,62 @@
 {
-  "schema_version": "1.4.0",
-  "id": "GHSA-crf3-v9rr-v7hj",
-  "modified": "2026-07-23T09:32:01Z",
-  "published": "2026-07-23T09:32:01Z",
-  "aliases": [
-    "CVE-2026-16723"
-  ],
-  "details": "A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16723"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-20"
+    "schema_version": "1.4.0",
+    "id": "GHSA-crf3-v9rr-v7hj",
+    "modified": "2026-07-28T21:47:00Z",
+    "published": "2026-07-23T09:32:01Z",
+    "aliases": [
+      "CVE-2026-16723"
+    ],
+    "summary": "Remote Code Execution via FNV-1a hash collision in AutoType validation in Fastjson2",
+    "details": "Fastjson2 versions 2.0.62 and earlier contain an FNV-1a hash collision bypass in AutoType type name validation. Attackers can use this collision to construct class name suffixes that match the hashes of built-in whitelisted
+  classes, triggering remote class loading and enabling arbitrary code execution.",
+    "severity": [
+      {
+        "type": "CVSS_V3",
+        "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
+      }
     ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2026-07-23T09:16:26Z"
+    "affected": [
+      {
+        "package": {
+          "ecosystem": "Maven",
+          "name": "com.alibaba.fastjson2:fastjson2"
+        },
+        "ranges": [
+          {
+            "type": "ECOSYSTEM",
+            "events": [
+              {
+                "introduced": "0"
+              },
+              {
+                "last_affected": "2.0.62"
+              }
+            ]
+          }
+        ]
+      }
+    ],
+    "references": [
+      {
+        "type": "ADVISORY",
+        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16723"
+      },
+      {
+        "type": "WEB",
+        "url": "https://github.com/alibaba/fastjson2/pull/7695"
+      },
+      {
+        "type": "WEB",
+        "url": "https://github.com/alibaba/fastjson2/pull/7703"
+      }
+    ],
+    "database_specific": {
+      "cwe_ids": [
+        "CWE-502"
+      ],
+      "severity": "CRITICAL",
+      "github_reviewed": false,
+      "github_reviewed_at": null,
+      "nvd_published_at": "2026-07-23T09:32:01Z"
+    }
   }
-}