CVE-2026-64609: Apache Fory Buffer Overflow Vulnerability

CVE-2026-64609 Overview

CVE-2026-64609 is an out-of-bounds read vulnerability in Apache Fory (formerly Apache Fury), a high-performance multi-language serialization framework. The flaw resides in the readAlignedVarUint() function, which uses sun.misc.Unsafe to perform direct memory access. When applications enable out-of-band zero-copy deserialization, this function can read beyond the bounds of the underlying buffer. The issue is tracked as [CWE-125: Out-of-bounds Read].

The vulnerability affects Apache Fory versions from 0.5.0 up to but not including 1.4.0. Versions prior to 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Only applications that explicitly opt-in to out-of-band zero-copy deserialization are exposed.

Critical Impact
Attackers can trigger out-of-bounds memory reads over the network without authentication, leading to information disclosure and process crashes with a CVSS score of 9.1.

Affected Products

Apache Fory 0.5.0 through 0.10.x (published as org.apache.fury:fury-core)
Apache Fory 0.11.0 through 1.3.x (published as org.apache.fory:fory-core)
Any Java application using Apache Fory with out-of-band zero-copy deserialization enabled

Discovery Timeline

2026-07-21 - CVE CVE-2026-64609 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-64609

Vulnerability Analysis

Apache Fory is a serialization framework optimized for cross-language, high-throughput data exchange. To achieve zero-copy performance, it uses sun.misc.Unsafe for direct memory operations that bypass Java's standard bounds checking. The readAlignedVarUint() function decodes variable-length unsigned integers from an aligned buffer position.

When an application enables out-of-band zero-copy deserialization, buffer data can originate from an untrusted source. The readAlignedVarUint() implementation fails to validate that the current read offset plus the maximum varint length remains within the buffer boundary. An attacker who supplies a crafted payload can force the deserializer to read memory beyond the buffer's allocated region.

The network-accessible attack vector requires no authentication or user interaction. Successful exploitation compromises confidentiality by exposing adjacent heap memory and availability by triggering SIGSEGV or IndexOutOfBoundsException failures that terminate the JVM process.

Root Cause

The root cause is missing boundary validation in readAlignedVarUint() when combined with unchecked pointer arithmetic through sun.misc.Unsafe. Because Unsafe operations do not enforce array bounds, the function trusts caller-supplied offsets. In out-of-band zero-copy mode, these offsets can be attacker-controlled through crafted serialized payloads, allowing reads to walk past the end of the backing byte buffer.

Attack Vector

An attacker delivers a malicious Fory-serialized payload to any endpoint that deserializes untrusted input using out-of-band zero-copy mode. The payload contains crafted length prefixes or varint encodings that cause the reader position to advance beyond the buffer. The framework then executes an unchecked Unsafe.getInt() or equivalent read against out-of-bounds memory. Applications that use only default deserialization modes are not affected.

No public proof-of-concept exploit code is available. Refer to the Apache Mailing List Discussion and the OpenWall OSS-Security Update for the vendor's technical description.

Detection Methods for CVE-2026-64609

Indicators of Compromise

Unexpected JVM crashes with SIGSEGV signals or java.lang.IndexOutOfBoundsException originating from Fory deserialization stack frames
Repeated malformed deserialization errors logged from org.apache.fory.serializer or org.apache.fury.serializer packages
Anomalous inbound payloads targeting services that expose Fory-based RPC or messaging endpoints

Detection Strategies

Inventory Java applications and identify dependencies on org.apache.fory:fory-core or the legacy org.apache.fury:fury-core artifact using SBOM tooling or mvn dependency:tree
Search codebases for calls that enable out-of-band buffers, such as BufferObject usage or explicit out-of-band deserialization configuration
Instrument JVMs to log stack traces from Unsafe-related exceptions during deserialization

Monitoring Recommendations

Forward JVM crash dumps and application error logs to a centralized SIEM for correlation with inbound network traffic
Alert on repeated deserialization failures from the same source IP or client identity, which may indicate probing
Monitor network gateways for oversized or malformed Fory payloads sent to serialization endpoints

How to Mitigate CVE-2026-64609

Immediate Actions Required

Upgrade Apache Fory to version 1.4.0 or later, which contains the fix for the readAlignedVarUint() bounds check
If upgrading immediately is not possible, disable out-of-band zero-copy deserialization in application configuration
Restrict network exposure of any service that accepts Fory-serialized input from untrusted sources

Patch Information

The Apache Fory project fixed CVE-2026-64609 in version 1.4.0. Users on the legacy org.apache.fury:fury-core coordinate (versions before 0.11.0) must migrate to the new org.apache.fory:fory-core coordinate to receive the patch. Update the Maven or Gradle dependency declaration and rebuild all affected services. See the Apache Mailing List Discussion for the official announcement.

Workarounds

Disable out-of-band zero-copy deserialization and rely on the default deserialization path, which is not affected
Enforce strict allow-listing on deserialization endpoints so only authenticated internal clients can submit Fory payloads
Place a validating gateway or schema check in front of the Fory deserializer to reject payloads that exceed expected size bounds

bash

# Maven dependency update to the patched version
# pom.xml
<dependency>
  <groupId>org.apache.fory</groupId>
  <artifactId>fory-core</artifactId>
  <version>1.4.0</version>
</dependency>