Loading vulnerability…
Out-of-bounds Read in Apache Fory Zero-Copy Deserialization
CVE-2026-64609 is an out-of-bounds read vulnerability in Apache Fory, formerly Apache Fury. The flaw occurs in Java deserialization when the opt-in out-of-band zero-copy deserialization feature is used. In the affected code path, readAlignedVarUint() can read beyond the bounds of the underlying buffer through use of sun.misc.Unsafe. The issue affects Apache Fory versions from 0.5.0 before 1.4.0, including releases published before the project rename. Applications that do not use the out-of-band zero-copy deserialization feature are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause the deserialization routine to read memory outside the intended buffer boundaries. This can result in sensitive information disclosure from adjacent memory and may also lead to application instability or denial of service, depending on runtime conditions and how the deserialization path is exposed in the application.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, disable or avoid the opt-in out-of-band zero-copy deserialization feature. Restrict exposure of deserialization interfaces to trusted inputs only until the fixed version is deployed, since applications that do not use this feature are not affected by this issue.
Patch, then assume compromise.
Upgrade Apache Fory to version 1.4.0 or later, which contains the fix for this vulnerability. Environments using older releases published before the project rename should also move to a fixed release in the current supported version line.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.