CVE-2026-64606CWE-502

Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Critical · published July 21, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected

This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00782 · 55.5th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-07-21T10:43Z
EPSS history
Timeline
  • 21 JUL 10:43Z
    Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
    cvelistv5