Deserialization Vulnerability in Apache Fory Affecting Java Lambda Functionality
CVE-2026-64606

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Fory
Vendor
CVE Published:
21 July 2026

What is CVE-2026-64606?

A deserialization of untrusted data vulnerability exists in Apache Fory, allowing for potential bypass of class-registration checks during Java lambda deserialization. This flaw affects versions prior to 1.4.0, particularly targeting the lambda capture class. Users are urged to upgrade to the fixed version 1.4.0 to mitigate this issue effectively.

Affected Version(s)

Apache Fory 0.11.0 < 1.4.0

Apache Fory 0.5.0 < 0.11.0

References

https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwz...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Charles Vosburgh
.