CVE-2026-64606 — Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected…
Published: 2026-07-21 · CVSS: 9.8 · CVSS 3.1
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7