Executive brief
Apache Fory (formerly Fury) is a high-performance serialization framework used to convert data objects into formats suitable for storage or transmission. A security flaw exists in its optional 'zero-copy' feature that could allow an attacker to trigger an out-of-bounds memory read. While this specific report is categorized as low impact, memory safety issues in serialization libraries can sometimes lead to data exposure or application instability.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in Apache Fory (formerly Apache Fury) within the `readAlignedVarUint()` function. The issue is triggered during out-of-band zero-copy deserialization when using `sun.misc.Unsafe` to read data, allowing the process to read beyond the boundaries of the underlying buffer. This is an opt-in feature; applications not explicitly using zero-copy deserialization are unaffected. An attacker could potentially exploit this to access sensitive memory or cause a Denial of Service (DoS). The vulnerability is addressed in version 1.4.0.
Affected products
- Apache Software Foundation Apache Fory 0.5.0 to 1.3.x
- Apache Software Foundation Apache Fury (fury-core) 0.5.0 to 0.10.x
Timeline
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 1.4.0