PT-2026-61854 · Apache · Apache Fory

Feng Ning · CVE-2026-64609 · Publicado 2026-07-21 · Atualizado 2026-07-21

NVD

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.

This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-64609

Produtos afetados

Apache Fory

Referências · 2

• https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-64609 · Nota de Segurança