CVE-2026-64609
Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
| CWE | CWE-125 |
| Vendor | apache software foundation |
| Product | apache fory |
| Published | Jul 21, 2026 |
| Last Updated | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache fory
Be the first to know when new critical vulnerabilities affecting apache software foundation apache fory are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Fory
0.11.0 < 1.4.0
Apache Software Foundation / Apache Fory
0.5.0 < 0.11.0
References
Credits
🔍 Feng Ning from Innora Security Research