CVE-2026-64609

{
  "id": "CVE-2026-64609",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T10:16:25.057",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.\n\nThis issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Lectura fuera de límites a través de sun.misc.Unsafe en Apache Fory. Cuando se utiliza la deserialización de copia cero fuera de banda, readAlignedVarUint() puede leer más allá de los límites del búfer subyacente. La deserialización de copia cero fuera de banda es una característica de activación voluntaria; las aplicaciones que no la utilizan no se ven afectadas.\n\nEste problema afecta a Apache Fory (anteriormente Apache Fury): desde 0.5.0 antes de 1.4.0. Las versiones anteriores a 0.11.0 se publicaron bajo las coordenadas de Maven org.apache.fury:fury-core.\n\nSe recomienda a los usuarios actualizar a la versión 1.4.0, que corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Fory",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.fory:fory-core",
          "versions": [
            {
              "version": "0.11.0",
              "lessThan": "1.4.0",
              "versionType": "maven",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Fory",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.fury:fury-core",
          "versions": [
            {
              "version": "0.5.0",
              "lessThan": "0.11.0",
              "versionType": "maven",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T13:41:32.281643Z",
          "id": "CVE-2026-64609",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.5.0",
              "versionEndExcluding": "1.4.0",
              "matchCriteriaId": "7365F27C-ACED-43E0-9BCE-8EBFADEFD7DE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/21/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}