Loading story…
Apache disclosed CVE-2026-63317, a moderate-severity vulnerability in Apache OpenNLP that allows arbitrary class instantiation through multiple unvalidated extension-loading paths. The issue affects code paths that call Class.forName() and invoke a no-argument constructor without verifying the supplied class name or type, including model loading through XML feature generator descriptors in GeneratorFactory, untrusted format names handled by StreamFactoryRegistry, and the opennlp.interner.class system property.
Apache said exploitation depends on an attacker-useful class already being present on the application classpath and having side effects in its static initializer or constructor, making the flaw more constrained than typical remote code execution. The project fixed the issue by moving extension loading to an allowlist-based ExtensionLoader mechanism, and advised users to upgrade to patched releases and ensure model files, XML feature descriptors, and format names are accepted only from trusted sources.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache released fixed OpenNLP versions that replace the vulnerable extension-loading behavior with an allowlist-based ExtensionLoader mechanism. Users were advised to upgrade and to restrict model files and format names to trusted sources.
Apache disclosed CVE-2026-63317, a moderate-severity arbitrary class instantiation vulnerability in Apache OpenNLP caused by multiple Class.forName() code paths that instantiate attacker-influenced classes without validating class name or type. The disclosure described affected areas including XML feature generator descriptors, untrusted format names in StreamFactoryRegistry, and the opennlp.interner.class system property.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026
Apache disclosed **CVE-2026-64606**, a critical deserialization vulnerability in **Apache Fory** that lets attackers bypass class-registration checks during Java lambda deserialization through an auto-admitted `SerializedLambda` capturing interface. The flaw is tracked as **CWE-502** and carries a **CVSS 3.1** score reflecting network-exploitable, no-authentication impact with potential compromise of confidentiality, integrity, and availability. The issue affects `org.apache.fory:fory-core` versions from `0.11.0` before `1.4.0` and the earlier package line `org.apache.fury:fury-core` from `0.5.0` before `0.11.0`. Apache said the vulnerability was reported by **Charles Vosburgh** and fixed in **Apache Fory 1.4.0**; users are advised to upgrade immediately. A CISA SSVC entry listed exploitation as **none observed**, **automatable: yes**, and **technical impact: total**.
Jul 21, 2026
Apache disclosed **CVE-2026-71558**, a heap type confusion flaw in Apache Fory's C++ deserialization logic that affects versions `0.14.0` through versions before `1.5.0`. The vulnerability is triggered by a crafted input payload during polymorphic smart-pointer deserialization, allowing type compatibility checks to be bypassed so an incompatible object can be treated as the declared base type. Apache and downstream advisories warn that successful exploitation can cause undefined behavior and may lead to denial of service or **arbitrary code execution**. The issue is tracked as **CWE-502** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a network-exploitable flaw with high impact across confidentiality, integrity, and availability. Apache said applications that do not use Fory C++ polymorphic smart-pointer deserialization are not affected, and recommended upgrading to **Apache Fory `1.5.0`**, which fixes the bug. The vulnerability was reported by independent security researcher **Zhixi "Jace" Sun**, while CISA SSVC metadata listed exploitation as none observed, automatable as yes, and technical impact as total.
Aug 7, 2026