Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.fory:fory-core

4 known vulnerabilities (3 critical, 1 medium), with the versions each affects and the releases that fix them.

Latest release
1.7.7 (Oct 8, 2026): no advisory affects it
Newest unaffected release
1.7.7 (Oct 8, 2026), the latest release
Advisories
4 · 3 critical, 1 medium
Dependents
16
Releases
31 since 0.11.0 (Jun 9, 2025)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • CVE-2026-64606Critical 9.8

    Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

    Affected: from 0.11.0, fixed in 1.4.0.

    Fixed in 1.4.0 (released Jul 16, 2026, 5 days before disclosure).

    The latest release, 1.7.7, is not affected.

  • CVE-2026-64609Critical 9.1

    Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

    Affected: from 0.11.0, fixed in 1.4.0.

    Fixed in 1.4.0 (released Jul 16, 2026, 5 days before disclosure).

    The latest release, 1.7.7, is not affected.

  • CVE-2026-50076Critical 9.1

    Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

    Affected: fixed in 1.1.0; fixed in 1.1.0.

    Fixed in 1.1.0 (released May 28, 2026, 7 days before disclosure).

    The latest release, 1.7.7, is not affected.

  • CVE-2025-59328Medium 6.5

    Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data

    Affected: from 0.5.0, through 0.12.1; fixed in 0.12.2.

    Fixed in 0.12.2 (released Sep 5, 2025, 10 days before disclosure).

    The latest release, 1.7.7, is not affected.