{"id":"CVE-2026-64609","description":"Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.\n\nThis issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue.","cvssScore":9.1,"cvssVersion":"3.1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssMetrics":[{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","sourceName":"CISA-ADP","type":"Secondary"}],"cwes":["CWE-125"],"resolved":"MITIGATED-BY-RASP","published":"2026-07-21","lastModified":"2026-07-27","affectedProducts":[{"vendor":"apache","product":"fory","versionStart":"\u003e=0.5.0","versionEnd":"\u003c1.4.0"}],"totalAffectedProducts":1,"references":[{"url":"https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/21/6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}],"reasoning":{"decidingSource":"secure-rule-match","decidingReason":"Promoted to MITIGATED-BY-RASP (security rule): this CVE's description identifies a deserialization vulnerability that can be mitigated by an ARMR deserialization security rule at the JVM level, without requiring a CVE-specific patch. Matched by description (no specific CWE was assigned by NVD).","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"no-match"},{"rule":"cna-maven-package","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"CNA declares the affected component is a Maven artifact"},{"rule":"patch-hint","stage":"disposition","outcome":"no-match"},{"rule":"open-source-maven","stage":"disposition","outcome":"no-match"},{"rule":"poc-derivable","stage":"disposition","outcome":"no-match"},{"rule":"no-exploit","stage":"disposition","outcome":"matched","status":"NO-FIX-IDENTIFIED","detail":"No public exploits or POCs found in Exploit-DB, Nuclei templates, or GitHub POC repositories, and CISA's Vulnrichment assessment records no demonstrated exploit. No upstream fix reference or open-source Maven package was found either, so there is nothing to act on from either direction."},{"rule":"secure-rule-match","stage":"disposition","outcome":"matched","status":"MITIGATED-BY-RASP","detail":"Description mentions \"deserialization\" — mitigable by an ARMR deserialization security rule (CWE not assigned).","decisive":true},{"rule":"below-action-threshold","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit-published","stage":"disposition","outcome":"skipped"}],"affectedProducts":[{"vendor":"apache","product":"fory","isKnown":false,"cpe":"cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*"}]},"assessment":{"record":{"state":"active"},"protection":{"level":"full","mechanisms":["security-rule"]},"action":{"state":"available","type":"security-rule"},"review":{"state":"automated","basis":"inferred"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.00777,"percentile":0.53845},"ssvc":{"available":true,"exploitation":"none","automatable":"yes","technicalImpact":"partial"}}