Fory
Monthly
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.
Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CWE-502 root cause and 9.8 CVSS score make it a high-priority patch for any service that deserializes untrusted input with the C++ implementation.
Unsafe deserialization in Apache Fory fory-core Java SDK versions prior to 1.1.0 allows remote attackers to bypass the framework's class registration, TypeChecker, and DisallowedList security controls on Java/JVM platforms. By crafting malicious Fory-serialized payloads that exercise the replace-resolve path, an attacker can invoke arbitrary readResolve/readExternal hooks on any class present on the classpath, enabling gadget-chain abuse without authentication. No public exploit identified at time of analysis, but the CVSS 9.1 score and CWE-502 classification reflect the high impact typical of Java deserialization sinks.
Pickle deserialization RCE in pyfory 0.12.0-0.12.2 and pyfury 0.1.0-0.10.3.
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.
Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CWE-502 root cause and 9.8 CVSS score make it a high-priority patch for any service that deserializes untrusted input with the C++ implementation.
Unsafe deserialization in Apache Fory fory-core Java SDK versions prior to 1.1.0 allows remote attackers to bypass the framework's class registration, TypeChecker, and DisallowedList security controls on Java/JVM platforms. By crafting malicious Fory-serialized payloads that exercise the replace-resolve path, an attacker can invoke arbitrary readResolve/readExternal hooks on any class present on the classpath, enabling gadget-chain abuse without authentication. No public exploit identified at time of analysis, but the CVSS 9.1 score and CWE-502 classification reflect the high impact typical of Java deserialization sinks.
Pickle deserialization RCE in pyfory 0.12.0-0.12.2 and pyfury 0.1.0-0.10.3.
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.