CVE-2026-64606 — Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

CVE-2026-64606

Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface PUBLISHED

Description (CNA)

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Fory	affected 0.11.0 before 1.4.0
Apache Software Foundation / Apache Fory	affected 0.5.0 before 0.11.0

CWE

CWE-502

References

https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/07/21/4