Apache Fury deserialization vulnerability (CNVD-2026-30659)

Apache Fury is a high-performance serialization framework that supports multiple languages such as Java and C++. It is widely used in distributed systems and message queues to handle cross-language or cross-process data exchanges. Before version 1.4.0, Apache Fury had a deserialization...

CVE-2026-64606 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the...

CVE-2026-64606

A deserialization vulnerability exists in Apache Fury (a high-performance serialization framework) versions prior to 1.4.0 . The root cause is insufficient validation of lambda expression classes during Java deserialization, specifically affecting the lambda capture class . An attacker can constr...

CVE-2026-64606

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the...

CVE-2026-64606: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the...

CVE-2026-50076

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via...