Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 6 total.
Heap type confusion in Apache Fory C++ polymorphic deserialization (CVE-2026-71558)
A heap type confusion vulnerability in Apache Fory's C++ deserialization allows a crafted input payload to bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an inc...
Fixed in Apache Fory 1.5.0
DeserializationPolicy bypass in Apache Fory PyFory ReduceSerializer (CVE-2026-48207)
PyFory's ReduceSerializer fails to enforce DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution when operating in Python-native mode with strict mode disabled. Applications...
Fixed in 1.0.0
Out-of-bounds read in Apache Fory zero-copy Java deserialization (CVE-2026-64609)
Apache Fory contains an out-of-bounds read vulnerability via `sun.misc.Unsafe` in its zero-copy deserialization path. When out-of-band zero-copy deserialization is enabled, the `readAlignedVarUint()` method can read b...
Fixed in 1.4.0
Heap type confusion and out-of-bounds read/write in Apache Fory C++ (CVE-2026-64608)
Apache Fory's C++ implementation contains a heap type confusion and out-of-bounds read/write vulnerability in its compatible-mode deserialization logic. Field-skip paths fail to validate declared field types against a...
Fixed in 1.4.0
Use-after-free in Apache Fory Rust deserialization (CVE-2026-60080)
A use-after-free vulnerability exists in the Rust deserialization logic of Apache Fory (fory-core). A crafted Fory payload can trigger undefined behavior, a process crash, or potential memory disclosure. Users are rec...
Fixed in 1.4.0
Class-registration bypass in Apache Fory Java lambda deserialization (CVE-2026-64606)
Apache Fory contains a deserialization of untrusted data vulnerability that allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected. An attacker ab...
Fixed in 1.4.0