Junglewise Threat Intelligence

CVE-2026-64606: Apache Fury deserialization bypass in Java lambda deserialization

CVE-2026-64606 · Severity: info · CVSS 0 · Published 2026-07-21

Technologies: Apache Software Foundation Fury. Vendors: Apache Software Foundation.

Executive brief

Apache Fury, a high-performance serialization framework used for data transfer in Java applications, contains a vulnerability in how it handles Java lambda functions. An attacker could potentially bypass security checks that restrict which classes are allowed to be registered during data processing. This could lead to unauthorized data manipulation or unexpected behavior in applications using the library.

Technical details

A deserialization of untrusted data vulnerability exists in Apache Fury (formerly Fory) versions prior to 1.4.0. The flaw resides in the Java lambda deserialization process, where class-registration checks can be bypassed. Specifically, the vulnerability affects the lambda capture class. An attacker providing maliciously crafted serialized data could exploit this to bypass security constraints intended to restrict class loading. The issue is resolved in version 1.4.0.

Affected products

  • Apache Software Foundation Apache Fury 0.5.0 to 1.3.1

Timeline

  • 2026-07-21: advisory: CVE-2026-64606 published by Apache Software Foundation
  • 2026-07-21: patched: Fix released in version 1.4.0

References

Related threats