CVE-2026-64609: Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/foryto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
If you do not need it, do not use the opt-in out-of-band zero-copy deserialization feature (applications that do not use it are not affected).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64609?
CVE-2026-64609 has a severity rating of 9.1, classified as critical.
How do I fix CVE-2026-64609?
To mitigate CVE-2026-64609, ensure that your application does not use the out-of-band zero-copy deserialization feature.
What causes CVE-2026-64609?
CVE-2026-64609 is caused by an out-of-bounds read vulnerability in the readAlignedVarUint() function due to improper handling in Apache Fory.
Who is affected by CVE-2026-64609?
Only applications utilizing the out-of-band zero-copy deserialization feature in Apache Fory are affected by CVE-2026-64609.
Is CVE-2026-64609 exploitable remotely?
Yes, CVE-2026-64609 can be exploited remotely through vulnerable implementations of Apache Fory.