CVE-2026-64606 PUBLISHED

Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Assigner: apache
Reserved: 20.07.2026 Published: 21.07.2026 Updated: 21.07.2026

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected

This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Fory
Versions Default: unaffected
  • affected from 0.11.0 to 1.4.0 (excl.)
Vendor Apache Software Foundation
Product Apache Fory
Versions Default: unaffected
  • affected from 0.5.0 to 0.11.0 (excl.)

Credits

  • Charles Vosburgh reporter

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE