Security researchers at ThreatBook and Imperva have been tracking a critical vulnerability in Fastjson, a popular JSON library for Java developed by Alibaba. The issue, tracked as CVE-2026-16723, allows attackers to inject malicious code into Spring Boot applications, which can execute with the privileges of the Java process.
According to ThreatBook and Imperva, attackers are targeting the vulnerability in affected Spring Boot applications, exploiting the lack of a patched version. The researchers warn that this could lead to unauthorized code execution, potentially compromising sensitive data.
Fastjson, a widely used library for parsing and generating JSON data, has been affected by this vulnerability. The attackers are using the flaw to inject malicious JSON requests into Spring Boot applications, which can then execute arbitrary code without authentication.
The vulnerability has significant implications for developers who use Spring Boot applications, as it can potentially allow attackers to execute code with the privileges of the Java process. ThreatBook and Imperva advise developers to update their applications to the latest version of Fastjson or take alternative measures to mitigate the risk.