You are viewing a plain text version of this content. The canonical link for it is here.

Posted to announce@apache.org by Chaokun Yang <ch...@apache.org> on 2026/07/21 09:58:09 UTC

CVE-2026-64606: Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Severity: important 

Affected versions:

- Apache Fory (org.apache.fory:fory-core) 0.5.0 before 1.4.0

Description:

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected


This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Credit:

Charles Vosburgh (reporter)

References:

https://fory.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-64606