CVE-2026-64606

CVE-2026-64606: Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Vendor Apache Software Foundation

Product Apache Fory

Weakness CWE-502 · Unsafe deserialization

Published July 21, 2026

Last update July 21, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Key dates

02Disclosure timeline

July 21, 2026 CVE published

July 21, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-64606 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities

Identifiers

CVE CVE-2026-64606

CWE CWE-502

Affected versions

Vendor Apache Software Foundation

Product Apache Fory

Affected ≥ 0.11.0 and < 1.4.0

Vendor Apache Software Foundation

Product Apache Fory

Affected ≥ 0.5.0 and < 0.11.0

CVE-2026-64606: Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

01Description

02Disclosure timeline

03References

04Related CVE