{
  "from_raw": "Chaokun Yang <chaokunyang@apache.org>",
  "from": "Chaokun Yang <ch...@apache.org>",
  "gravatar": "5dac1def761b1a642c93c34593f74545",
  "to": "an...@apache.org,\n de...@fory.apache.org",
  "subject": "CVE-2026-64609: Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization",
  "message-id": "<70b70efd-1b07-8d1e-3b44-0f17417ca24a@apache.org>",
  "mid": "1rtopo9bsm659tfx220n9q34625qwsty",
  "permalinks": [
    "1rtopo9bsm659tfx220n9q34625qwsty",
    "r9445f2cad07df7efc662d6c2f6c06ece499e1f66b9b4b545b763c831@<announce.apache.org>"
  ],
  "dbid": "87ac743f9f81df463d6c9a43fb6b2933b4967119df69383966a8bd389f2263bf",
  "cc": "de...@fory.apache.org",
  "epoch": 1784625548,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/07/21 09:19:08",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: moderate \n\nAffected versions:\n\n- Apache Fory (org.apache.fory:fory-core) 0.11.0 before 1.4.0\n- Apache Fory (org.apache.fury:fury-core) 0.5.0 before 0.11.0\n\nDescription:\n\nOut-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.\n\nThis issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue.\n\nCredit:\n\nFeng Ning from Innora Security Research (reporter)\n\nReferences:\n\nhttps://fory.apache.org\nhttps://www.cve.org/CVERecord?id=CVE-2026-64609\n\n",
  "body_short": "Severity: moderate \n\nAffected versions:\n\n- Apache Fory (org.apache.fory:fory-core) 0.11.0 before 1.4.0\n- Apache Fory (org.apache.fury:fury-core) 0.5.0 before 0.11.0\n\nDescription:\n\nOut-of-bounds read vi",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 2836,
  "id": "1rtopo9bsm659tfx220n9q34625qwsty"
}