Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the readAlignedVarUint function when out-of-band zero-copy deserialization is used. An attacker can access sensitive information or crash the application by providing specially crafted serialized data that triggers...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the readAlignedVarUint function when out-of-band zero-copy deserialization is used. An attacker can access sensitive information or crash the application by providing specially crafted serialized data that triggers...

CVE-2026-64609: Out-of-bounds Read

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...