Loading vulnerability…
Class-registration bypass in Apache Fory Java lambda deserialization
CVE-2026-64606 is a deserialization of untrusted data vulnerability in Apache Fory affecting Java lambda deserialization. The flaw may allow Apache Fory's class-registration checks to be bypassed when processing a SerializedLambda, and the issue is limited to the lambda capture class. Affected versions are Apache Fory before 1.4.0, including package lines identified as org.apache.fory:fory-core from 0.11.0 before 1.4.0 and org.apache.fury:fury-core from 0.5.0 before 0.11.0. Because the vulnerability weakens a security control intended to restrict deserializable classes, it can expose applications that deserialize untrusted data to broader insecure deserialization risk.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass class-registration restrictions during Java lambda deserialization, undermining a core safety mechanism in Apache Fory. In applications that accept attacker-controlled serialized input, this may enable unauthorized deserialization of otherwise disallowed classes and can lead to severe downstream consequences associated with insecure deserialization, including compromise of confidentiality, integrity, and availability. Available scoring information characterizes the technical impact as total.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, avoid deserializing untrusted or attacker-controlled data with Apache Fory, especially where Java lambda deserialization may occur. Restrict or disable exposure of deserialization endpoints to untrusted sources, enforce strict trust boundaries around serialized inputs, and review application use of lambda serialization until the fixed version can be deployed. These measures reduce exposure but do not replace upgrading to a patched release.
Patch, then assume compromise.
Upgrade Apache Fory to version 1.4.0 or later. The vendor states that version 1.4.0 fixes this vulnerability. Environments still using the earlier package naming lineage should move to a fixed release in the supported Apache Fory line that includes the 1.4.0 fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.