CVE-2026-31072

NameCVE-2026-31072
DescriptionThe JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apscheduler (PTS)bullseye3.7.0-1vulnerable
bookworm3.9.1-2vulnerable
trixie3.11.0-1vulnerable
forky, sid3.11.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apschedulersource(unstable)(unfixed)

Notes

https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6

Search for package or bug name: Reporting problems