Loading story…
Apache disclosed CVE-2026-64609, an out-of-bounds read vulnerability in Apache Fory (formerly Apache Fury) caused by use of sun.misc.Unsafe during out-of-band zero-copy Java deserialization. The flaw occurs in readAlignedVarUint(), which can read beyond the underlying buffer bounds, and is tracked as CWE-125. The issue carries a CVSS v3.1 score reflecting network-exploitable impact with no privileges or user interaction required: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
The vulnerability affects Apache Fory versions 0.5.0 through before 1.4.0, including releases published before 0.11.0 under the Maven coordinates org.apache.fury:fury-core. Apache said the bug only affects applications that explicitly enable the opt-in out-of-band zero-copy deserialization feature, and recommended upgrading to version 1.4.0 to remediate the issue. Available disclosure data indicates no known exploitation so far, though the flaw is considered automatable and can cause partial technical impact.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Apache recommended upgrading to version 1.4.0 to remediate CVE-2026-64609. The fixed release addresses the out-of-bounds read vulnerability in the zero-copy deserialization feature.
A vulnerability identified as CVE-2026-64609 was disclosed in Apache Fory (formerly Apache Fury) as an out-of-bounds read caused by use of sun.misc.Unsafe during opt-in out-of-band zero-copy Java deserialization. The issue affects versions 0.5.0 before 1.4.0, including older releases published as org.apache.fury:fury-core.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-64606**, a critical deserialization vulnerability in **Apache Fory** that lets attackers bypass class-registration checks during Java lambda deserialization through an auto-admitted `SerializedLambda` capturing interface. The flaw is tracked as **CWE-502** and carries a **CVSS 3.1** score reflecting network-exploitable, no-authentication impact with potential compromise of confidentiality, integrity, and availability. The issue affects `org.apache.fory:fory-core` versions from `0.11.0` before `1.4.0` and the earlier package line `org.apache.fury:fury-core` from `0.5.0` before `0.11.0`. Apache said the vulnerability was reported by **Charles Vosburgh** and fixed in **Apache Fory 1.4.0**; users are advised to upgrade immediately. A CISA SSVC entry listed exploitation as **none observed**, **automatable: yes**, and **technical impact: total**.
Jul 21, 2026
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026
Apache disclosed **CVE-2026-64608**, a critical vulnerability in the **Apache Fory C++** implementation that can cause heap type confusion and out-of-bounds read/write during deserialization. The flaw occurs in compatible mode when field-skip paths do not properly validate declared field types against the actual data being processed, creating a memory-corruption condition that could have severe impact on affected deployments. The issue affects **Apache Fory C++ versions `0.14.0` through before `1.4.0`** and does **not** affect other Apache Fory language implementations. Apache has advised users to upgrade to **`1.4.0`** to remediate the bug. The vulnerability was reported by **Nguyen Van Hiep (`@hypnguyen1209`) of MBBank**, and CISA SSVC metadata indicates **no known exploitation** so far, while noting the issue may be **automatable** and carries **total technical impact**.
Jul 21, 2026