CVE-2026-64606: Apache Fory Auth Bypass Vulnerability

CVE-2026-64606 Overview

CVE-2026-64606 is a deserialization of untrusted data vulnerability in Apache Fory that allows attackers to bypass class-registration checks during Java lambda deserialization. The flaw affects the lambda capture class handling path and enables execution of unregistered classes when processing attacker-controlled serialized data. Apache Fory versions before 1.4.0 are affected, and the project has released version 1.4.0 to remediate the issue. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Attackers can bypass class-registration allowlists during Java lambda deserialization in Apache Fory, potentially leading to arbitrary code execution over the network without authentication.

Affected Products

Apache Fory versions prior to 1.4.0
Java applications using Apache Fory for object serialization
Services accepting Fory-serialized lambda capture classes from untrusted sources

Discovery Timeline

2026-07-21 - CVE-2026-64606 published to NVD
2026-07-21 - Apache mailing list and Openwall OSS-Security advisories released
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-64606

Vulnerability Analysis

Apache Fory is a multi-language serialization framework that includes a class-registration mechanism to restrict which types may be deserialized. This allowlist is a primary defense against Java deserialization attacks. CVE-2026-64606 breaks that defense along the lambda deserialization path.

When Fory deserializes a Java lambda capture class, the registration check that normally validates the concrete class type is bypassed. An attacker can craft a serialized payload that reaches the lambda capture code path and references classes that were never explicitly allowed by the application. This converts a mitigated deserialization surface into an exploitable one.

Because Fory typically operates on network-received payloads and the attack requires no authentication or user interaction, exploitation can yield remote code execution in the context of the receiving Java Virtual Machine (JVM).

Root Cause

The root cause is inconsistent enforcement of the class-registration allowlist across serialization codecs. The lambda capture class deserializer resolves and instantiates classes without routing them through the same registration check applied to standard object deserialization. This gap permits attacker-controlled types to be instantiated during lambda reconstruction.

Attack Vector

Exploitation requires an attacker to submit crafted Fory-serialized data to an endpoint that deserializes untrusted input. The payload is structured as a lambda capture class serialization, which triggers the vulnerable code path. Once the registration check is skipped, standard Java gadget chains can be leveraged to escalate to arbitrary code execution within the JVM process. Refer to the Apache Fory mailing list advisory and the Openwall OSS-Security advisory for technical detail.

Detection Methods for CVE-2026-64606

Indicators of Compromise

Unexpected instantiation of classes not present in the Fory registration allowlist during runtime.
JVM stack traces referencing LambdaSerializer or lambda capture deserialization paths tied to inbound network traffic.
Outbound network connections or child process creation originating from Java services that terminate Fory deserialization.

Detection Strategies

Inventory all applications and services that include Apache Fory as a dependency and identify those on versions earlier than 1.4.0.
Inspect deserialization endpoints for logs indicating deserialization of lambda types from external sources.
Deploy runtime application self-protection or JVM security manager policies that flag reflective class loading during Fory operations.

Monitoring Recommendations

Alert on anomalous process execution such as java spawning shells or scripting interpreters on services that handle Fory payloads.
Monitor for spikes in deserialization exceptions and class-not-found errors originating from Fory codepaths.
Correlate inbound serialized payload sizes and patterns with subsequent suspicious JVM behavior.

How to Mitigate CVE-2026-64606

Immediate Actions Required

Upgrade Apache Fory to version 1.4.0 or later across all affected services.
Audit application code paths that call Fory deserialization APIs on network-sourced data and restrict exposure until patched.
Rotate credentials and secrets accessible to any Java service confirmed to have processed untrusted Fory payloads.

Patch Information

The Apache Fory project has released version 1.4.0, which fixes the class-registration bypass in the lambda deserialization path. Users should upgrade directly to 1.4.0 or newer. No backported patches for earlier release lines have been referenced in the advisory. See the Apache Fory advisory thread for release details.

Workarounds

Disable deserialization of Fory payloads from untrusted or unauthenticated sources until the upgrade is deployed.
Place affected services behind an authenticated gateway and enforce strict allowlists of upstream clients.
Enforce network segmentation to limit which systems can reach Fory deserialization endpoints.

bash

# Configuration example: pin Apache Fory to a fixed version in Maven
# pom.xml dependency block
# <dependency>
#   <groupId>org.apache.fory</groupId>
#   <artifactId>fory-core</artifactId>
#   <version>1.4.0</version>
# </dependency>

mvn versions:set-property -Dproperty=fory.version -DnewVersion=1.4.0
mvn dependency:tree | grep fory