Executive brief
Apache Fury, a high-performance serialization framework used for data transfer in Java applications, contains a vulnerability in how it handles Java lambda functions. An attacker could potentially bypass security checks that restrict which classes are allowed to be registered during data processing. This could lead to unauthorized data manipulation or unexpected behavior in applications using the library.
Technical details
A deserialization of untrusted data vulnerability exists in Apache Fury (formerly Fory) versions prior to 1.4.0. The flaw resides in the Java lambda deserialization process, where class-registration checks can be bypassed. Specifically, the vulnerability affects the lambda capture class. An attacker providing maliciously crafted serialized data could exploit this to bypass security constraints intended to restrict class loading. The issue is resolved in version 1.4.0.
Affected products
- Apache Software Foundation Apache Fury 0.5.0 to 1.3.1
Timeline
- 2026-07-21: advisory: CVE-2026-64606 published by Apache Software Foundation
- 2026-07-21: patched: Fix released in version 1.4.0