PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64609 Apache CVE debrief

CVE-2026-64609 is a critical vulnerability in Apache Fory, a software project formerly known as Apache Fury. The issue allows for an out-of-bounds read via sun.misc.Unsafe, specifically when using out-of-band zero-copy deserialization. This feature is opt-in, meaning applications not using it are not affected. The vulnerability impacts Apache Fory versions from 0.5.0 up to but not including 1.4.0. Users are advised to upgrade to version 1.4.0 to fix the issue.

Vendor
Apache
Product
Fory
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Developers and administrators using Apache Fory (formerly Apache Fury) versions 0.5.0 through 1.3.x should be concerned about this vulnerability. Given the critical severity and high CVSS score of 9.1, immediate attention is recommended to ensure the security of affected systems.

Technical summary

The vulnerability CVE-2026-64609 in Apache Fory arises from an out-of-bounds read issue via sun.misc.Unsafe. This occurs when the software uses out-of-band zero-copy deserialization, a feature that must be explicitly opted into. The readAlignedVarUint() function can read beyond the buffer's bounds, potentially leading to security issues. The affected versions range from 0.5.0 to before 1.4.0. It's crucial to note that applications not utilizing out-of-band zero-copy deserialization are not impacted. The solution is to upgrade to version 1.4.0, which addresses this vulnerability.

Defensive priority

High priority should be given to Apache Fory instances using out-of-band zero-copy deserialization, especially in environments where security is paramount. Immediate action to upgrade to version 1.4.0 is recommended.

Recommended defensive actions

  • Inventory and verify the versions of Apache Fory in use, specifically checking for versions between 0.5.0 and 1.3.x.
  • Disable out-of-band zero-copy deserialization if not required, as a temporary measure until an upgrade can be performed.
  • Upgrade to Apache Fory version 1.4.0 or later to patch the vulnerability.
  • Monitor systems for any suspicious activity that could be related to this vulnerability.
  • Review and adjust security configurations to prevent exploitation.

Evidence notes

The CVE record and NVD detail provide the primary sources of information for this vulnerability. Additional references from Apache and third-party advisories offer further context and mitigation strategies.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64609 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64609

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64609 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64609

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.