Is CVE-2026-64606 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64606 being exploited in the wild.

How severe is CVE-2026-64606?

Informational severity, with a CVSS score of 0, published 21 July 2026.

Which products and versions are affected?

Apache Software Foundation Fury 0.5.0 to 1.3.1.

Is there a fix for CVE-2026-64606?

A patch was published on 2026-07-21: Fix released in version 1.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64606 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-64606?

Check whether you run Apache Software Foundation Fury at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64606: Apache Fury deserialization bypass in Java lambda deserialization

CVE-2026-64606 · Severity: info · CVSS 0 · Published 2026-07-21

Apache Fury, a high-performance serialization framework used for data transfer in Java applications, contains a vulnerability in how it handles Java lambda functions. An attacker could potentially bypass security checks that restrict which classes are allowed to be registered during data processing. This could lead to unauthorized data manipulation or unexpected behavior in applications using the library.

Technologies: Apache Software Foundation Fury. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-64606 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64606 being exploited in the wild.
How severe is CVE-2026-64606?: Informational severity, with a CVSS score of 0, published 21 July 2026.
Which products and versions are affected?: Apache Software Foundation Fury 0.5.0 to 1.3.1.
Is there a fix for CVE-2026-64606?: A patch was published on 2026-07-21: Fix released in version 1.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64606 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-64606?: Check whether you run Apache Software Foundation Fury at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization of untrusted data vulnerability exists in Apache Fury (formerly Fory) versions prior to 1.4.0. The flaw resides in the Java lambda deserialization process, where class-registration checks can be bypassed. Specifically, the vulnerability affects the lambda capture class. An attacker providing maliciously crafted serialized data could exploit this to bypass security constraints intended to restrict class loading. The issue is resolved in version 1.4.0.

Affected products

Apache Software Foundation Apache Fury 0.5.0 to 1.3.1

Timeline

2026-07-21: advisory: CVE-2026-64606 published by Apache Software Foundation
2026-07-21: patched: Fix released in version 1.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.