cveboard RSS feed

CVE-2026-64609

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Apache Fory

Vendor
Apache Software Foundation
Product
Apache Fory
Platforms
Unknown
Default status
unaffected
Package
org.apache.fory:fory-core
Package collection
https://repo.maven.apache.org/maven2
Apache Fory · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0.11.0affectedmaven1.4.0UnavailableNone listed

Apache Fory

Vendor
Apache Software Foundation
Product
Apache Fory
Platforms
Unknown
Default status
unaffected
Package
org.apache.fury:fury-core
Package collection
https://repo.maven.apache.org/maven2
Apache Fory · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0.5.0affectedmaven0.11.0UnavailableNone listed