CVE-2026-64608

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

CVE-2026-64608

Apache Fory: C++ implementation suffers a heap type confusion and out-of-bounds read/write during deserialization in compatible mode. Inconsistent schemas between declared field types and data can trigger memory access issues. Affected: Apache Fory C++ from 0.14.0 up to but not including 1.4.0. R...

CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

SummaryPrior to langgraph-checkpoint version 3.0 , LangGraph’s JsonPlusSerializer used as the default serialization protocol for all checkpointing contains a remote code execution RCE vulnerability when deserializing payloads saved in the "json" serialization mode.If an attacker can cause your...