CVE-2026-64606

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc	Vendor Advisory Issue Tracking
http://www.openwall.com/lists/oss-security/2026/07/21/4	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de deserialización de datos no confiables que puede permitir que las comprobaciones de registro de clases sean eludidas durante la deserialización de lambdas de Java. Solo la clase de captura de lambda se ve afectada. Este problema afecta a Apache Fory: desde antes de 1.4.0. Se recomienda a los usuarios actualizar a la versión 1.4.0, que corrige el problema.

Information

Published : 2026-07-21 11:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-64606

Mitre link : CVE-2026-64606

CVE.ORG link : CVE-2026-64606

JSON object : View

Products Affected

apache

fory

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-64606", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64606", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T13:46:59.365782Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Fory", "versions": [{"status": "affected", "version": "0.11.0", "lessThan": "1.4.0", "versionType": "semver"}], "packageName": "org.apache.fory:fory-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Fory", "versions": [{"status": "affected", "version": "0.5.0", "lessThan": "0.11.0", "versionType": "semver"}], "packageName": "org.apache.fury:fury-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T11:16:27.973", "references": [{"url": "https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/21/4", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected\n\n\nThis issue affects Apache Fory: from before 1.4.0.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de deserializaci\u00f3n de datos no confiables que puede permitir que las comprobaciones de registro de clases sean eludidas durante la deserializaci\u00f3n de lambdas de Java. Solo la clase de captura de lambda se ve afectada.\n\nEste problema afecta a Apache Fory: desde antes de 1.4.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.4.0, que corrige el problema."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7365F27C-ACED-43E0-9BCE-8EBFADEFD7DE", "versionEndExcluding": "1.4.0", "versionStartIncluding": "0.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}