CVE-2026-64606

published 2026-07-21

CVE-2026-64606: Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture…

Priority P2 64 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected

This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	fory	>= 0.5.0 < 1.4.0	1.4.0
apache_software_foundation	apache_fory	>= 0.11.0 < 1.4.0	1.4.0
apache_software_foundation	apache_fory	>= 0.5.0 < 0.11.0	0.11.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502