Apache Fory <1.4.0 Deserialization Vulnerability (Lambda Class-Registration Bypass)
CVE-2026-64606 Published on July 21, 2026
Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected
This issue affects Apache Fory: from before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2026-64606 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Products Associated with CVE-2026-64606
Want to know whenever a new CVE is published for Apache Fory? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Fory:- Version 0.11.0 and below 1.4.0 is affected.
- Version 0.5.0 and below 0.11.0 is affected.