Apache Fory Patches Four Deserialization Flaws Across Java, C++, and Rust

TL;DR

The Apache Fory project disclosed four vulnerabilities on July 21, 2026. Three carry an important rating, and one is moderate. Version 1.4.0 fixes all of them.

Why it matters

Fory is a fast serialization framework for cross-language data exchange. Serialization code sits directly in the path of untrusted input. So bugs here can turn a data feed into an attack surface. These Apache Fory vulnerabilities span three language implementations at once. That breadth is unusual and widens the blast radius. Notably, the project has patched several deserialization issues this year already.

How the attacks work

Java: class-registration bypass

CVE-2026-64606 is the one to watch. It lets attackers bypass class-registration checks during Java lambda deserialization. Registration allowlists are a core defense against deserialization attacks. Only the lambda capture class is affected.

C++: type confusion

CVE-2026-64608 hits the C++ implementation only. In compatible mode, field-skip paths fail to validate declared field types against the real data. A mismatched schema can therefore trigger type confusion and out-of-bounds memory access.

Rust and zero-copy Java

CVE-2026-60080 is a use-after-free in Rust deserialization logic. A crafted payload could crash the process or disclose memory. Meanwhile, CVE-2026-64609 allows an out-of-bounds read via sun.misc.Unsafe. It only affects out-of-band zero-copy deserialization, which is opt-in. Applications not using that feature are safe from it.

Affected versions

The Java flaws reach back to 0.5.0. The C++ bug starts at 0.14.0, and the Rust bug covers 0.13.0 through 1.3.0. Watch the rename, since builds before 0.11.0 shipped as org.apache.fury:fury-core. Newer builds use org.apache.fory:fory-core.

Patch steps

Upgrade to Fory 1.4.0, which resolves all four issues. Grab it from the official Apache Fory download page. Also check transitive dependencies, since Fory often ships inside other tools. No public exploit or in-the-wild abuse has been confirmed. Even so, patching these Apache Fory vulnerabilities early is the safer path.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.