CVE-2026-64606
CRITICAL
CVSS 9.8
apache_fory
Verified Advisory
Class-registration bypass in Apache Fory Java lambda deserialization (CVE-2026-64606)
Apache Fory contains a deserialization of untrusted data vulnerability that allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected. An attacker able to supply untrusted serialized data could exploit this bypass to deserialize otherwise-restricted classes.
Affected versions:
- Apache Fory (org.apache.fory:fory-core) 0.5.0 before 1.4.0
We recommend updating to: 1.4.0.
CVSS 9.8 · our assessment: act_now
Reference: https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc
Details: https://vuln.today/cve/CVE-2026-64606
Verified by vuln.today against published advisories.
Affected versions
- – Apache Fory (org.apache.fory:fory-core) 0.5.0 before 1.4.0
Fixed in: 1.4.0
More advisories for apache_fory
- CVE-2026-71558 – Heap type confusion in Apache Fory C++ polymorphic deserialization (CVE-2026-71558)
- CVE-2026-48207 – DeserializationPolicy bypass in Apache Fory PyFory ReduceSerializer (CVE-2026-48207)
- CVE-2026-64609 – Out-of-bounds read in Apache Fory zero-copy Java deserialization (CVE-2026-64609)
- CVE-2026-64608 – Heap type confusion and out-of-bounds read/write in Apache Fory C++ (CVE-2026-64608)
- CVE-2026-60080 – Use-after-free in Apache Fory Rust deserialization (CVE-2026-60080)