CVE-2026-64609

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/21/6	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Lectura fuera de límites a través de sun.misc.Unsafe en Apache Fory. Cuando se utiliza la deserialización de copia cero fuera de banda, readAlignedVarUint() puede leer más allá de los límites del búfer subyacente. La deserialización de copia cero fuera de banda es una característica de activación voluntaria; las aplicaciones que no la utilizan no se ven afectadas. Este problema afecta a Apache Fory (anteriormente Apache Fury): desde 0.5.0 antes de 1.4.0. Las versiones anteriores a 0.11.0 se publicaron bajo las coordenadas de Maven org.apache.fury:fury-core. Se recomienda a los usuarios actualizar a la versión 1.4.0, que corrige el problema.

Information

Published : 2026-07-21 10:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-64609

Mitre link : CVE-2026-64609

CVE.ORG link : CVE-2026-64609

JSON object : View

Products Affected

apache

fory

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-64609", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64609", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T13:41:32.281643Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Fory", "versions": [{"status": "affected", "version": "0.11.0", "lessThan": "1.4.0", "versionType": "maven"}], "packageName": "org.apache.fory:fory-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Fory", "versions": [{"status": "affected", "version": "0.5.0", "lessThan": "0.11.0", "versionType": "maven"}], "packageName": "org.apache.fury:fury-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T10:16:25.057", "references": [{"url": "https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/21/6", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.\n\nThis issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue."}, {"lang": "es", "value": "Lectura fuera de l\u00edmites a trav\u00e9s de sun.misc.Unsafe en Apache Fory. Cuando se utiliza la deserializaci\u00f3n de copia cero fuera de banda, readAlignedVarUint() puede leer m\u00e1s all\u00e1 de los l\u00edmites del b\u00fafer subyacente. La deserializaci\u00f3n de copia cero fuera de banda es una caracter\u00edstica de activaci\u00f3n voluntaria; las aplicaciones que no la utilizan no se ven afectadas.\n\nEste problema afecta a Apache Fory (anteriormente Apache Fury): desde 0.5.0 antes de 1.4.0. Las versiones anteriores a 0.11.0 se publicaron bajo las coordenadas de Maven org.apache.fury:fury-core.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.4.0, que corrige el problema."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7365F27C-ACED-43E0-9BCE-8EBFADEFD7DE", "versionEndExcluding": "1.4.0", "versionStartIncluding": "0.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}