Loading story…
Apache disclosed CVE-2026-64606, a critical deserialization vulnerability in Apache Fory that lets attackers bypass class-registration checks during Java lambda deserialization through an auto-admitted SerializedLambda capturing interface. The flaw is tracked as CWE-502 and carries a CVSS 3.1 score reflecting network-exploitable, no-authentication impact with potential compromise of confidentiality, integrity, and availability.
The issue affects org.apache.fory:fory-core versions from 0.11.0 before 1.4.0 and the earlier package line org.apache.fury:fury-core from 0.5.0 before 0.11.0. Apache said the vulnerability was reported by Charles Vosburgh and fixed in Apache Fory 1.4.0; users are advised to upgrade immediately. A CISA SSVC entry listed exploitation as none observed, automatable: yes, and technical impact: total.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On the oss-sec mailing list, Apache Fory disclosed CVE-2026-64606 as a deserialization of untrusted data vulnerability that can bypass class-registration checks via a SerializedLambda capturing interface. The notice credited Charles Vosburgh as the reporter and advised users to upgrade to version 1.4.0.
Apache Fory addressed CVE-2026-64606, a deserialization flaw that could bypass class-registration checks during Java lambda deserialization, by releasing version 1.4.0. The issue affects earlier Apache Fory and Apache Fury package lines identified in the advisories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026
Apache disclosed **CVE-2026-64609**, an out-of-bounds read vulnerability in **Apache Fory** (formerly Apache Fury) caused by use of `sun.misc.Unsafe` during out-of-band zero-copy Java deserialization. The flaw occurs in `readAlignedVarUint()`, which can read beyond the underlying buffer bounds, and is tracked as **CWE-125**. The issue carries a CVSS v3.1 score reflecting network-exploitable impact with no privileges or user interaction required: `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`. The vulnerability affects Apache Fory versions **0.5.0 through before 1.4.0**, including releases published before **0.11.0** under the Maven coordinates `org.apache.fury:fury-core`. Apache said the bug only affects applications that explicitly enable the opt-in out-of-band zero-copy deserialization feature, and recommended upgrading to **version 1.4.0** to remediate the issue. Available disclosure data indicates **no known exploitation** so far, though the flaw is considered automatable and can cause partial technical impact.
Jul 21, 2026
Apache disclosed **CVE-2026-64608**, a critical vulnerability in the **Apache Fory C++** implementation that can cause heap type confusion and out-of-bounds read/write during deserialization. The flaw occurs in compatible mode when field-skip paths do not properly validate declared field types against the actual data being processed, creating a memory-corruption condition that could have severe impact on affected deployments. The issue affects **Apache Fory C++ versions `0.14.0` through before `1.4.0`** and does **not** affect other Apache Fory language implementations. Apache has advised users to upgrade to **`1.4.0`** to remediate the bug. The vulnerability was reported by **Nguyen Van Hiep (`@hypnguyen1209`) of MBBank**, and CISA SSVC metadata indicates **no known exploitation** so far, while noting the issue may be **automatable** and carries **total technical impact**.
Jul 21, 2026