Apache Fury deserialization vulnerability (CNVD-2026-30659)

Apache Fury is a high-performance serialization framework that supports multiple languages such as Java and C++. It is widely used in distributed systems and message queues to handle cross-language or cross-process data exchanges. Before version 1.4.0, Apache Fury had a deserialization...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the readAlignedVarUint function when out-of-band zero-copy deserialization is used. An attacker can access sensitive information or crash the application by providing specially crafted serialized data that triggers...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the readAlignedVarUint function when out-of-band zero-copy deserialization is used. An attacker can access sensitive information or crash the application by providing specially crafted serialized data that triggers...

CVE-2026-64609

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

PT-2026-61854

Name of the Vulnerable Software and Affected Versions Apache Fory versions 0.5.0 through 1.3.x Description An out-of-bounds read occurs via sun.misc.Unsafe when out-of-band zero-copy deserialization is utilized. In this scenario, the readAlignedVarUint function can read data beyond the boundaries...