CVE-2026-64606

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected

This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Fory	>= 0.11.0, < 1.4.0
Apache Software Foundation	Apache Fory	>= 0.5.0, < 0.11.0

References

https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrscVendor Advisory, Issue Tracking
http://www.openwall.com/lists/oss-security/2026/07/21/4Third Party Advisory

Timeline

Published: Jul 21, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-646075.3HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounte CVE-2026-646089.8Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the fiel CVE-2026-646099.1Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read bey CVE-2026-646109.8Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache servi CVE-2026-646117.5A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised CVE-2026-646127.5A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error reco CVE-2026-646136.2Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. The segment is CVE-2026-646143.8Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The s CVE-2026-646153.3Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The s CVE-2026-646163.3Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The CVE-2026-646173.8Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The CVE-2026-646189.8Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through versio