Loading story…
Apache disclosed CVE-2026-64608, a critical vulnerability in the Apache Fory C++ implementation that can cause heap type confusion and out-of-bounds read/write during deserialization. The flaw occurs in compatible mode when field-skip paths do not properly validate declared field types against the actual data being processed, creating a memory-corruption condition that could have severe impact on affected deployments.
The issue affects Apache Fory C++ versions 0.14.0 through before 1.4.0 and does not affect other Apache Fory language implementations. Apache has advised users to upgrade to 1.4.0 to remediate the bug. The vulnerability was reported by Nguyen Van Hiep (@hypnguyen1209) of MBBank, and CISA SSVC metadata indicates no known exploitation so far, while noting the issue may be automatable and carries total technical impact.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-64608 record was updated on 2026-07-21 with a CVSS v3.1 vector indicating critical impact and CISA SSVC metadata. The metadata noted no known exploitation, automatable exploitation potential, and total technical impact.
Apache recommended upgrading affected Apache Fory C++ deployments to version 1.4.0 to remediate CVE-2026-64608. The fix guidance accompanied the public disclosure of the vulnerability.
A security advisory disclosed CVE-2026-64608, a heap type confusion flaw that can lead to out-of-bounds read and write during deserialization in Apache Fory C++ compatible mode. The advisory states that versions 0.14.0 before 1.4.0 are affected and that other language implementations are not impacted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-64606**, a critical deserialization vulnerability in **Apache Fory** that lets attackers bypass class-registration checks during Java lambda deserialization through an auto-admitted `SerializedLambda` capturing interface. The flaw is tracked as **CWE-502** and carries a **CVSS 3.1** score reflecting network-exploitable, no-authentication impact with potential compromise of confidentiality, integrity, and availability. The issue affects `org.apache.fory:fory-core` versions from `0.11.0` before `1.4.0` and the earlier package line `org.apache.fury:fury-core` from `0.5.0` before `0.11.0`. Apache said the vulnerability was reported by **Charles Vosburgh** and fixed in **Apache Fory 1.4.0**; users are advised to upgrade immediately. A CISA SSVC entry listed exploitation as **none observed**, **automatable: yes**, and **technical impact: total**.
Jul 21, 2026
Apache disclosed **CVE-2026-64609**, an out-of-bounds read vulnerability in **Apache Fory** (formerly Apache Fury) caused by use of `sun.misc.Unsafe` during out-of-band zero-copy Java deserialization. The flaw occurs in `readAlignedVarUint()`, which can read beyond the underlying buffer bounds, and is tracked as **CWE-125**. The issue carries a CVSS v3.1 score reflecting network-exploitable impact with no privileges or user interaction required: `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`. The vulnerability affects Apache Fory versions **0.5.0 through before 1.4.0**, including releases published before **0.11.0** under the Maven coordinates `org.apache.fury:fury-core`. Apache said the bug only affects applications that explicitly enable the opt-in out-of-band zero-copy deserialization feature, and recommended upgrading to **version 1.4.0** to remediate the issue. Available disclosure data indicates **no known exploitation** so far, though the flaw is considered automatable and can cause partial technical impact.
Jul 21, 2026
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026