open-source-dependency-vulnerabilityproof-of-concept-release

Critical Apache Fory Deserialization Flaw Bypasses Class Registration Checks

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 21, 2026

Apache disclosed CVE-2026-64606, a critical deserialization vulnerability in Apache Fory that lets attackers bypass class-registration checks during Java lambda deserialization through an auto-admitted SerializedLambda capturing interface. The flaw is tracked as CWE-502 and carries a CVSS 3.1 score reflecting network-exploitable, no-authentication impact with potential compromise of confidentiality, integrity, and availability.

The issue affects org.apache.fory:fory-core versions from 0.11.0 before 1.4.0 and the earlier package line org.apache.fury:fury-core from 0.5.0 before 0.11.0. Apache said the vulnerability was reported by Charles Vosburgh and fixed in Apache Fory 1.4.0; users are advised to upgrade immediately. A CISA SSVC entry listed exploitation as none observed, automatable: yes, and technical impact: total.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 21, 2026

Jul 21, 20264mo ago
oss-sec discloses CVE-2026-64606 affecting Apache Fory
On the oss-sec mailing list, Apache Fory disclosed CVE-2026-64606 as a deserialization of untrusted data vulnerability that can bypass class-registration checks via a SerializedLambda capturing interface. The notice credited Charles Vosburgh as the reporter and advised users to upgrade to version 1.4.0.
oss-sec: CVE-2026-64606: Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
Jul 21, 20264mo ago
Apache Fory fixes CVE-2026-64606 in version 1.4.0
Apache Fory addressed CVE-2026-64606, a deserialization flaw that could bypass class-registration checks during Java lambda deserialization, by releasing version 1.4.0. The issue affects earlier Apache Fory and Apache Fury package lines identified in the advisories.
CVE-2026-64606 - Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Class-registration bypass in Apache Fory Java lambda deserialization (CVE-2026-64606)

Organizations

1 linked

Apache Software Foundation

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Oss Security Mailing ListNews · Jul 21, 2026

oss-sec: CVE-2026-64606: Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interfaceOpen source ↗

Cvefeed High SeverityAdvisories · Jul 21, 2026

CVE-2026-64606 - Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interfaceOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Apache Fory Deserialization Flaw Bypasses Class Registration Checks

How this story unfolded

oss-sec discloses CVE-2026-64606 affecting Apache Fory

Apache Fory fixes CVE-2026-64606 in version 1.4.0

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Fory Deserialization Flaw Lets Attackers Bypass Java Safety Checks

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization

Apache Fory C++ Deserialization Flaw Could Enable Remote Code Execution

Critical Apache Fory Deserialization Flaw Bypasses Class Registration Checks

How this story unfolded

oss-sec discloses CVE-2026-64606 affecting Apache Fory

Apache Fory fixes CVE-2026-64606 in version 1.4.0

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Fory Deserialization Flaw Lets Attackers Bypass Java Safety Checks

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization

Apache Fory C++ Deserialization Flaw Could Enable Remote Code Execution