open-source-dependency-vulnerabilitywidely-deployed-product-advisoryinternet-facing-service-vulnerability

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 21, 2026

Apache disclosed CVE-2026-64609, an out-of-bounds read vulnerability in Apache Fory (formerly Apache Fury) caused by use of sun.misc.Unsafe during out-of-band zero-copy Java deserialization. The flaw occurs in readAlignedVarUint(), which can read beyond the underlying buffer bounds, and is tracked as CWE-125. The issue carries a CVSS v3.1 score reflecting network-exploitable impact with no privileges or user interaction required: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

The vulnerability affects Apache Fory versions 0.5.0 through before 1.4.0, including releases published before 0.11.0 under the Maven coordinates org.apache.fury:fury-core. Apache said the bug only affects applications that explicitly enable the opt-in out-of-band zero-copy deserialization feature, and recommended upgrading to version 1.4.0 to remediate the issue. Available disclosure data indicates no known exploitation so far, though the flaw is considered automatable and can cause partial technical impact.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 21, 2026

Jul 21, 20264mo ago
Apache Fory 1.4.0 recommended as fix for CVE-2026-64609
Apache recommended upgrading to version 1.4.0 to remediate CVE-2026-64609. The fixed release addresses the out-of-bounds read vulnerability in the zero-copy deserialization feature.
CVE-2026-64609 - Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
Jul 21, 20264mo ago
Apache Fory discloses CVE-2026-64609 out-of-bounds read flaw
A vulnerability identified as CVE-2026-64609 was disclosed in Apache Fory (formerly Apache Fury) as an out-of-bounds read caused by use of sun.misc.Unsafe during opt-in out-of-band zero-copy Java deserialization. The issue affects versions 0.5.0 before 1.4.0, including older releases published as org.apache.fury:fury-core.
CVE-2026-64609 - Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Out-of-bounds Read in Apache Fory Zero-Copy Deserialization (CVE-2026-64609)

Organizations

1 linked

Apache Software Foundation

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Oss Security Mailing ListNews · Jul 21, 2026

oss-sec: CVE-2026-64609: Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserializationOpen source ↗

Cvefeed High SeverityAdvisories · Jul 21, 2026

CVE-2026-64609 - Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserializationOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization

How this story unfolded

Apache Fory 1.4.0 recommended as fix for CVE-2026-64609

Apache Fory discloses CVE-2026-64609 out-of-bounds read flaw

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Apache Fory Deserialization Flaw Bypasses Class Registration Checks

Apache Fory Deserialization Flaw Lets Attackers Bypass Java Safety Checks

Apache Fory C++ Deserialization Flaw Could Enable Remote Code Execution

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization

How this story unfolded

Apache Fory 1.4.0 recommended as fix for CVE-2026-64609

Apache Fory discloses CVE-2026-64609 out-of-bounds read flaw

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Apache Fory Deserialization Flaw Bypasses Class Registration Checks

Apache Fory Deserialization Flaw Lets Attackers Bypass Java Safety Checks

Apache Fory C++ Deserialization Flaw Could Enable Remote Code Execution