CVE-2026-64606

Published: Lug 21, 2026 Last Modified: Lug 27, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,8
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected

This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

502

Deserialization of Untrusted Data

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Application Data Unexpected State Dos: Resource Consumption (Cpu) Varies By Context
Applicable Platforms
Languages: Java, Ruby, PHP, Python, JavaScript
Technologies: Not Technology-Specific, ICS/OT, AI/ML
Likelihood of Exploit: Medium
View CWE Details
Application

Fory by Apache

Product Information
Vendor Apache
Product Fory
Version Range Affected
From 0.5.0 (inclusive)
To 1.4.0 (exclusive)
cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
http://www.openwall.com/lists/oss-security/2026/07/21/4
http://www.openwall.com/lists/oss-security/2026/07/21/4
https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh…
https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc