CVE-2026-64606: fallo crítico en Apache Fory
Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.8%
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected
This issue affects Apache Fory: from before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache ForyCVEs relacionadas — Apache Fory
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-61622CRITICALApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyEPSS 49.0%CVE-2026-71558CRITICALApache Fory: Heap type confusion in C++ polymorphic smart-pointer deserializationEPSS 1.0%CVE-2026-64608CRITICALApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsEPSS 0.8%CVE-2026-71559HIGHApache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadataEPSS 0.8%CVE-2026-64609CRITICALApache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserializationEPSS 0.8%CVE-2026-71560CRITICALApache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-pathEPSS 0.8%