Vulnerabilities

TI-2026-46169 CVE-2026-64606 · GHSA-qwm7-r3rv-3hw8

Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

MEDIUM 50

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00782 Published 2026-07-21 Fixed in 1.4.0, 0.11.0 CWE-502

TI-2026-46172 CVE-2026-64609 · GHSA-8w3v-jcfp-ffw5

MEDIUM 47

Out-of-bounds read via sun.misc.Unsafe in Apache Fory.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00777 Published 2026-07-21 Fixed in 1.4.0, 0.11.0 CWE-125

TI-2026-46171 CVE-2026-64608 · GHSA-wh2x-66qr-23v8

MEDIUM 50

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00806 Published 2026-07-21 Fixed in 1.4.0 CWE-502