CVE-2026-64609 Apache CVE debrief

Who should care

Developers and administrators using Apache Fory (formerly Apache Fury) versions 0.5.0 through 1.3.x should be concerned about this vulnerability. Given the critical severity and high CVSS score of 9.1, immediate attention is recommended to ensure the security of affected systems.

Technical summary

The vulnerability CVE-2026-64609 in Apache Fory arises from an out-of-bounds read issue via sun.misc.Unsafe. This occurs when the software uses out-of-band zero-copy deserialization, a feature that must be explicitly opted into. The readAlignedVarUint() function can read beyond the buffer's bounds, potentially leading to security issues. The affected versions range from 0.5.0 to before 1.4.0. It's crucial to note that applications not utilizing out-of-band zero-copy deserialization are not impacted. The solution is to upgrade to version 1.4.0, which addresses this vulnerability.

Defensive priority

High priority should be given to Apache Fory instances using out-of-band zero-copy deserialization, especially in environments where security is paramount. Immediate action to upgrade to version 1.4.0 is recommended.

Recommended defensive actions

• Inventory and verify the versions of Apache Fory in use, specifically checking for versions between 0.5.0 and 1.3.x.
• Disable out-of-band zero-copy deserialization if not required, as a temporary measure until an upgrade can be performed.
• Upgrade to Apache Fory version 1.4.0 or later to patch the vulnerability.
• Monitor systems for any suspicious activity that could be related to this vulnerability.
• Review and adjust security configurations to prevent exploitation.

Evidence notes

The CVE record and NVD detail provide the primary sources of information for this vulnerability. Additional references from Apache and third-party advisories offer further context and mitigation strategies.

Official resources