Apache Fory
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_fory:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Fory (c56235de-e080-5ebb-b9eb-56a159ca8acb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-64609 |
vulnerable | 2026-07-29 01:06:19.768764 |
Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2026-07-21T09:34:57.010Z
Updated: 2026-07-21T18:28:17.440Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64608 |
vulnerable | 2026-07-29 01:06:19.768575 |
Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.
This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2026-07-21T09:34:12.817Z
Updated: 2026-07-21T18:28:16.365Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64606 |
vulnerable | 2026-07-29 01:06:19.768219 |
Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected
This issue affects Apache Fory: from before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2026-07-21T10:43:51.436Z
Updated: 2026-07-21T18:28:15.293Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-60080 |
vulnerable | 2026-07-29 01:03:23.717435 |
Apache Fory: Rust MetaString heap use-after-free
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.
A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2026-07-21T10:54:19.298Z
Updated: 2026-07-22T16:12:10.640Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50076 |
vulnerable | 2026-06-08 08:07:02.788745 |
Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data.
Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.
Published: 2026-06-04T16:09:03.212Z
Updated: 2026-06-04T17:01:57.229Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48207 |
vulnerable | 2026-06-08 08:05:12.266893 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-61622 |
vulnerable | 2026-06-08 07:37:27.676099 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59328 |
vulnerable | 2026-06-08 07:35:21.670655 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.