CVE-2026-64606: Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

[Chaokun Yang <chaokunyang () apache org>]

Severity: important 

Affected versions:

- Apache Fory (org.apache.fory:fory-core) 0.5.0 before 1.4.0

Description:

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java 
lambda deserialization. Only lambda capture class is affected


This issue affects Apache Fory: from before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Credit:

Charles Vosburgh (reporter)

References:

https://fory.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-64606