{"id":"CVE-2026-64609","summary":"Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization","details":"Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.\n\nThis issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue.","modified":"2026-08-12T16:41:43.070562Z","published":"2026-07-21T09:34:57.010Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64609.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.11.0"},{"fixed":"1.4.0"},{"introduced":"0.5.0"},{"fixed":"0.11.0"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"0.5.0"},{"fixed":"1.4.0"},{"fixed":"0.11.0"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/07/21/6"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64609.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64609"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/fory","events":[{"introduced":"0"},{"fixed":"cc91f02d95945c3534920eb075dcff60ce0b435c"}],"database_specific":{"source":"DESCRIPTION","extracted_events":[{"introduced":"0"},{"fixed":"0.11.0"}]}}],"database_specific":{"vanir_signatures_modified":"2026-08-12T16:41:43Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java"},"deprecated":false,"digest":{"line_hashes":["177363880195282771255642702297707353069","57400381701205228328367951400608269918","267928844915268583191244861122159188898","8781303066409428664158149406778788962","216109104940456622477779787452491735607","6730570837733545500291220133931311744","91167477035033247104690568278398425014","28154903035585858640426722688750183913","326229802816129590441944998913510309265","238831395903958091338890603954000341537","2193499928271380864558503268849757234","33765086267650442712366364010043433541","153799106857375362461120125737227541154","338136925246914388929467459741302531122","332519046981785276116278828421170578683","198728866793584960142803048599093538667","137616428104686158183686447876650677577","286926144956515776514223570490708356012","13310967999975964718425968734519329210","335902213056213830552097445097275951941","313722166710297815546076155121942553163","193236632528456135153419906951518357318","154570192737377649758440338286093091175","238856195202721201324998714454945482288","213976981681802063438209491039506316768","182835219104844604846520567836297989199","56445120422370432107297528310517788777","140368451182316025590194468121559131774"],"threshold":0.9},"id":"CVE-2026-64609-01fc652f"},{"digest":{"length":1625,"function_hash":"42451626266369789638695224143987010258"},"id":"CVE-2026-64609-099662b9","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java","function":"buildDecodeExpression"},"deprecated":false},{"target":{"function":"inferField","file":"java/fory-format/src/main/java/org/apache/fory/format/type/TypeInference.java"},"deprecated":false,"digest":{"function_hash":"57502227135372266915665569455283082831","length":5062},"id":"CVE-2026-64609-0c32901c","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c"},{"deprecated":false,"digest":{"function_hash":"64862335666524616398601377012350108103","length":45},"id":"CVE-2026-64609-1567011a","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java","function":"encodedType"}},{"digest":{"function_hash":"244224884963891280645824907198363590432","length":1881},"id":"CVE-2026-64609-158eb7c2","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"function":"buildFieldType","file":"java/fory-core/src/main/java/org/apache/fory/meta/ClassDef.java"},"deprecated":false},{"deprecated":false,"digest":{"length":1212,"function_hash":"161539031762898585129588817538786868139"},"id":"CVE-2026-64609-15f86470","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java","function":"isSupported"}},{"target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/XtypeResolver.java","function":"buildClassInfo"},"deprecated":false,"digest":{"function_hash":"285999295017721204352138146955089529469","length":1448},"id":"CVE-2026-64609-224c9fa9","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c"},{"source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java"},"deprecated":false,"digest":{"line_hashes":["128376195914510865089369049632660483900","254523651412088333825579986646957411272","63711029647093202937540714316216222805","94269900221290050349726351856014925111","3567222832444109133588993495490721011","314505024564639013566216199921435846045","177387284766167113270278849552872048782","270074171582006727299655683384822285693","84196879195447044516691702548973029107","28154696943350677872770252605497490206","204960662178788800207404917261810654362","333780576253508963834316297073067246567","314254777766523131017641642467561416683","4026155326875979157912289725638251167","128391430005365186298984401626083934472","57844838590826776471487337818779259761","217309634030833027408908633022771588610","250733954389632432680552628763307016215","49804037694185556953550762139898046577","303412450854482676605558640982768785894","14113927542139008042532492141185885232","311123815683340001857603548108054403731","196085794903732001118884369120059921593","319838937940713976548021315147581335481","34283346495987518718302036333368351799","175896832266881769317063835172389960350","146406441205860667147716347881976719532","144014100042240532945827016513069689469","91773826475512539143063893098025488796","295148160528929648648331071605771930047","280694034396900870590462594041289644131","146915409640185665205097398022741665930","287367126425361977578759324814237108652","160619241904525633485072526636868065629","147614427327713115662772000648504733482","159137556278201095255713742099594328176","93632072380949358855627360801627419248","158995191819191812820568098922399395273","321691290822507766481071743852849344054","293053055722750326948680592117562206744","198229292217064141816853630962755523524","268191775749315638210280275266697946169","225025566040806177965040624280598528462","50924055608374450595048008013126742680","292506716949143079085295859382438489652","227963408642751315468859647482513937835","129509610368625439867334230655348340620","18244000515648236543207398115172488212","253562700411624176747999102830798027932","30425380489070326989377360254519306143","102290930141451228410540883939325048652","239602258571777583556004018533669969970","43426142835678480996635914106713565766","245063218586109855902808130158693539033","131978437740218827411283215754977826538","209698914186207654439777691106014721677","214498868715723226239619971519002422671"],"threshold":0.9},"id":"CVE-2026-64609-2306c4d9","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java","function":"register"},"deprecated":false,"digest":{"function_hash":"39710749106385790515369426341403061663","length":975},"id":"CVE-2026-64609-26d4ebab"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"function":"toTypeToken","file":"java/fory-core/src/main/java/org/apache/fory/meta/ClassDef.java"},"deprecated":false,"digest":{"length":481,"function_hash":"117570666171722528709087159669421315121"},"id":"CVE-2026-64609-315c8894"},{"target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java","function":"serializeFor"},"deprecated":false,"digest":{"length":4333,"function_hash":"215855599549723564937642089664411670817"},"id":"CVE-2026-64609-39a6aaad","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c"},{"deprecated":false,"digest":{"line_hashes":["204126710891923963864859384180663628891","304043332886506038783437960514487331353","193250636797402252997933709395763724083","23578324719450857808192847738457593119","86214691474558800446402344626113569418","307341713504808257282916939506392408373","190220099594319248092455816175157893593","46314709150845473022920351573913068300","324655353945924831763140347825828834174","77902719094785947751385039904563204574","94872471544479206690745845118304470521","273671238733723338542460594163487175156","314538087240792128608613173527495981582","270446884649083052218201219430617348533"],"threshold":0.9},"id":"CVE-2026-64609-46e00543","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/type/CustomTypeRegistry.java"}},{"deprecated":false,"digest":{"function_hash":"159879472334664447605829541867958008470","length":354},"id":"CVE-2026-64609-46f24599","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java","function":"writeClassInternal"}},{"deprecated":false,"digest":{"function_hash":"65127933177075422404074507562800404445","length":1110},"id":"CVE-2026-64609-4e8e1495","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java","function":"listBeansRecursiveInclusive"}},{"id":"CVE-2026-64609-51cbf284","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeHandler.java"},"deprecated":false,"digest":{"line_hashes":["112872382249674849585139489858030656014","315498983511793526534800895674040181144","254860430178737207678513114312008530530","215838929714933749373670169659017724720","54171691321487945063552587322101755616","263350101921321932495107776718211625382","53818198820614618293664688845459375942","151664087317715513502756302191276502477","75323024397555384353369863517786955198","295645846483097110336143292029397499370","289535441946452471089676181925437696547"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeEncoderRegistry.java","function":"accept"},"deprecated":false,"digest":{"function_hash":"323533300234616702103469082259301568275","length":1101},"id":"CVE-2026-64609-52c2f1d6","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java","function":"deserializeForCollection"},"deprecated":false,"digest":{"function_hash":"19441292333554383320461173875341715609","length":435},"id":"CVE-2026-64609-5f0faf39","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayDataForEach.java"},"deprecated":false,"digest":{"line_hashes":["127290275288847601020487886401940127050","77035765733250553951956088324556272736","157212076880784298797254226352418912264","19088433916083246296537697377442779977"],"threshold":0.9},"id":"CVE-2026-64609-64c33a64","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayEncoderBuilder.java"},"deprecated":false,"digest":{"line_hashes":["53468411064354626692101253226368638782","1823460947581469900262894662307221626","49917847013776937029508080003678945695","226727652721210893092188403631026807545","188914735713465246979554147870517492791","225300872844652805128035214214015670226","167317080891620314003581242048894935111","146062281232003313723477375955039299103"],"threshold":0.9},"id":"CVE-2026-64609-652f08dc","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/type/TypeInference.java"},"deprecated":false,"digest":{"line_hashes":["214828719082474293742671622392862839712","188754650296935162173052717888294396302","151106443547447572410350175291723788826","227549233894693055246206714103169428372","40514199685546084024414756060816179570","179227681237092516613927473781687056516","230161258845022054275471885193198999175","309910709185364670627141355649019763735","278211964857334855540857057289631451444","26190485595635263498596904487797626920","278480514794015872309525848262999024816","250481531357687580907609342253500145486","293222973606157155555625159357963018314","79643729532061177606930755228974100607","130518108832279050445318806189233377298","149738715167571367944380690294219769105","296448714140738297748369687904637004942","281492406805225521683053959141000619136","45717092642420109503030376349116274679","67190366628643992044257594813707967863","209395406132555238946939339819160742882","266034625519105560115632639454680191618","28355889551484502350659006627519269983","323553881255286208607478889276179010861","305886810588871631875077145689870503047","24754764183591905225645339868001758216","138725674194163311772356170083603556828","226581271432277160670721145436967863345","301106366956569546747972769806223719953","82424579476189590868237125914541928091","266039040299757088973811342878946146687","314596663582849983063796263950324316139","272417304289299367168326192945258401608","36935001515025120601957046921612359087"],"threshold":0.9},"id":"CVE-2026-64609-7902f870","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"37900811841876704036154387995768452490","length":846},"id":"CVE-2026-64609-79cb8a0d","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java","function":"register"}},{"deprecated":false,"digest":{"line_hashes":["254801131045325476032698240568439170788","85057182162501631264473236459180433248","71334589970451180819182512716997269257","207932222726691037985340832208982573142","224234504249652924107217689408853169776","302462078041103014881898882076935782188","308295519162224128065734619001778842234","309675991438554067507586657240718599328"],"threshold":0.9},"id":"CVE-2026-64609-7d586c49","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/meta/ClassDef.java"}},{"source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"function":"populateBytesToClassInfo","file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"},"deprecated":false,"digest":{"function_hash":"38915698567733575521963922919017710598","length":865},"id":"CVE-2026-64609-7e3f9e8f","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"273999064854575272482747310177375976934","length":342},"id":"CVE-2026-64609-7e5d362d","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayEncoderBuilder.java","function":"arrayDeserializeForCollection"},"deprecated":false},{"source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/CustomCodec.java"},"deprecated":false,"digest":{"line_hashes":["111460061501546647406582184363852520504","300588875233591183859711495287184249012","36957338686832202119363278278997629766","98491843637907615890380114631517934196","123782639160256095731344818134660515929","82502184198480883494919377376227822236","4466033812228245068280995422332239262","220965623606895933368023173534504051414","208196610233825096914360841165820463049","170027169715683051081537019473244344158","208291698084930560667063268346373202896","84257212446205692876771920737338672429","176224921825474159707752629401847346671","62767168201274214358491243488075419869","8359948299865572415566111032408765896","273333999839275478205548609112019234118","260938501707732613096123385981356576227","48902929647720362647844396956706200542","334943010135464500036033100362636188267","166120102303150338796115181046391215623","72193641832656809620132493764187612714","319540614313572531431152545284080753903","136446575903440197814745048685796402942","191505932036793593614027950374104457630","153243857435429877964346068624446671379","140313657270808172524106758680466616451","179022568482453329621057727351626820331","322325363528143941653306056364957818375","111958298255095661902548623330517078258"],"threshold":0.9},"id":"CVE-2026-64609-838dcdda","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["159353619880263815079858494251203511706","263798750388740425247295128324558790195","204858175704319258791757390166451383659","120488333963936941095971953110103301121"],"threshold":0.9},"id":"CVE-2026-64609-83bf4764","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/XtypeResolver.java"}},{"source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java","function":"buildEncodeExpression"},"deprecated":false,"digest":{"function_hash":"192490532957935979374861400591184127601","length":985},"id":"CVE-2026-64609-89e8470d","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"223590185313960708763450950676331550319","length":1021},"id":"CVE-2026-64609-8b2ce6ad","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java","function":"isBean"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java","function":"encodedType"},"deprecated":false,"digest":{"function_hash":"64862335666524616398601377012350108103","length":45},"id":"CVE-2026-64609-8d2cf208","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"111617422972431918913182307586908366683","length":1911},"id":"CVE-2026-64609-9369321a","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java","function":"deserializeForArray"}},{"digest":{"function_hash":"130529491778384829151104007917921651630","length":1050},"id":"CVE-2026-64609-98aabd10","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"function":"addDecoderMethods","file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java","function":"setClassInfo"},"deprecated":false,"digest":{"function_hash":"207890100621658045228545247722998021376","length":92},"id":"CVE-2026-64609-a0dd2483","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"39897848392374077419923549656423776681","length":620},"id":"CVE-2026-64609-a15b0cf4","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"function":"addSerializer","file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"}},{"digest":{"function_hash":"278140816873280359404378510860499597272","length":2388},"id":"CVE-2026-64609-a28324c6","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java","function":"deserializeFor"},"deprecated":false},{"deprecated":false,"digest":{"length":1382,"function_hash":"299733918788732979238816298421678870022"},"id":"CVE-2026-64609-a7bf8447","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java","function":"serializeForArrayByWriter"}},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayDataForEach.java","function":"ArrayDataForEach"},"deprecated":false,"digest":{"function_hash":"83353973451327832724793666790294968792","length":673},"id":"CVE-2026-64609-ad6f427c","signature_type":"Function"},{"digest":{"function_hash":"81857687506232180722923542276325749146","length":901},"id":"CVE-2026-64609-b820aaf3","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java","function":"createSerializer"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"284157324134793945237518830757653274395","length":107},"id":"CVE-2026-64609-ba6f7231","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java","function":"getField"}},{"deprecated":false,"digest":{"line_hashes":["187377162775745741327637036157163662705","250053219074730181063501425198091836597","230701710808174160380150977994247515078","99563890228891780729506109037486020316","142934390129700535078819556806409356573","318230937781540942883022935618267191436","259556775199416297117296320215378220494","160817509304320979913903882675448182184"],"threshold":0.9},"id":"CVE-2026-64609-bbf49db4","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeEncoderRegistry.java"}},{"digest":{"line_hashes":["119229906201455697690713978276896101788","285991542060345326877288048413612223347","26601012244152008113907810016570880166","167064327355242847448764458285601114905","292669035786754136962036372766132986414","31649242437563334563458788944994988638","169959512415459349657727599519917292393","131917753493023716328657326831898058957","293616791129380712046925985442953741730","310241999376683957283874345507607745289","200040783285870912453847109244142373876","30131816221253982728462302443350667223","40532142614670600148656322200581569530","232097299177140840154921844465406051615","322042340315687823551804594300940655490","117934037391636976438623910813291168172","236237278115396450982448149482533950148","306480521493604119028051144661882103497","100757263930863453612302250611368638262","76990823304255339826909655006540583929","141431962222020687179169444831436038931","54835740587243708398004075104297003880","191900368532931402389598655205770711","132795518955332835390462340656174736670","20315219711250116524566328134501530755","330532867994880608397334025596483995683","116111904702594821285792289188971256971","207013377186937778570561796960782667166","21432311923900181694758321936532936764","16485871063715614633951347919487063586","86001692510480381341463891062521330302","207154561018905570390423873650682860522","228374897267865425241679881127137480267","192234006688157784135042452970003971521","294430265102435213924100930134126746484","265981571278442209778616474725568949833","228374897267865425241679881127137480267","276800187578005415761492709193000484239","54142940307047321642150048946439990926","121913641119824678401503234904174468665","6601259981609045837043142650584923688","275940137506218523774717405172852768329","210213466204348314022261485038247576305","293616791129380712046925985442953741730","7893981196670010123635010538190886314","85970813340141970391928592214284614127","332283747052437452108663666161264957965","49166585094189416990505173024177791224","97065260656286151774918819744595203016","254843633116227868265124655829947629231","17045757656603560483698449872350252398","325920831122045343240305276478889754552","102825105902882101990346824885583038290","10622105551449514438773712810887277778","259776063338631780896601241147558566494","76661171045476159975670550757675996086","190190273326697099538503506048575194775","283575423399535239723486875314372446325","211014882821958746888091824861108216454","109718821004135155313416911210978659997","122473295207028651583568311095699473952","73260740273098171432928484813185462151","297070397922911318439174093925966139317","27216759405281806097090359958248762751","87237574895769033597169446344334837277","101259755285747009750196002963590980234","192305450784481470900443167558239509962","107167009415012590233145468221405340453","35280209259583704694945619756792534226","127883400547639856002735875503070277063","41932210954110002341784160578922052026","272331958285261734973834314946345619302","149596771833404514464383720937227599462","251446906334411881286161185767714692539","183367544454087916104895055985191057670","60205958770651110267668738285941124699","142013354363186981120184725032630321604","240203039790741084194819368027767284888","202543274536194668395150157982686125121","168122116656267311066519715608057255387","38121736744179936334404194067487759597","85103118569700450482023317808247115775","39492881937860286480260901089837769589","114138970059897039949874240605217362751","36217734701178304884595038485624290494","130682331884913968778681776838614456707","228959836036138983000994098194913584410","116493448915597932864469126942175442325","215718222089647643109981841614481308281","140472034006848413167214191382091827459"],"threshold":0.9},"id":"CVE-2026-64609-c7a28229","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java"},"deprecated":false},{"source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeEncoderRegistry.java","function":"genCode"},"deprecated":false,"digest":{"function_hash":"320078457426537591899968086352495990217","length":4293},"id":"CVE-2026-64609-e6cb4d0e","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c","target":{"file":"java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java"},"deprecated":false,"digest":{"line_hashes":["151069242058143991456563574004559928831","160897113438072771680024722565696840564","277959594692690425172593118910162022269","289811221658585349917560303423688048634","48974279877259636306485733673067557020","329998960453271398919816897900551278434","315692480328124092644642563883898851909","36041007274001501435053655981908792425","313415352359456740500273241510281204193","71013749213930692077871532588752595839","198833255783323673337313517378183675400","14745833355398784169037195601685873656","329692940237025455480519620121840640011","272455369102090402911435558878779741631","332165731635098400696846777444584559971","20480008613965755104966847668576758802","316182186805941399825209742624751046130","168989903449706602177669455441295505177","55484274676108572028876069255370441118","234478469724967895259680171152154181033","50096557968080300507430744972287983445","152737340784757050625526776655903882646","22456779680893605215385999716469113304","126191531082066035044558511789760037098","96395634340213233288902472529707560888","338524940449705874926953995671355944682","129398664733926739069020261881645654030","128336338323801927910544982179838739575","156469610314946931596841604583562956122","235812722676386941582757174664876341956","29291476330833459823381837368227063599","187287445502402784615468197364779781947","337875126494864465858801868217825676022","119620917668925117077438094405950384901","165013271755354387567811528687919522749","283435946534730870577821330932158695360","88482638506107581550759144620690692175","118213150722131366740575642636306890850","210251879238605875811001968787360287213","99041740325291661469613127851339475172","34296451464975190409816349484642305411","34017892630907288053821458296924833274","246630636599104622672958810994314358394","196654149937767152923697321776408845594","272760847090655094487907452409248867019","268654995407702629011586057950079292435","176826935306389704017781002390832352597","208573319244572890202023769289029932249","72212133335473706500420535896330034206","46490135998713089561303051262711039752","247796873068575226503196518299383969778","306704358771870200272529508122838161973","201303631860255395429154399848828664117","120334259922754409750156720028318871267","291918397038410698018883144014433784104","15583539670146634319574386598084360379","205010110861294163263909043499388531351","336667581878475305512992264696802659720","190144174437601457817161596411488852826","214023200188170166954324304239715608379","117095868026967524758816832000985800203","331853485865545223815495492218519466262","254567980028758509399872555969278614714","166943318700544420047953001567764122681","259880999385306167407618578460369245280","105799921537995592937954542369919341917","305335784915979260795476218660174315316","209201044519899157363709845472140675247","8686154070294529462446488270689330543","200689322357214021015594512077845393412"],"threshold":0.9},"id":"CVE-2026-64609-f56e18a1","signature_type":"Line"},{"target":{"file":"java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"},"deprecated":false,"digest":{"line_hashes":["212452144717488038146598384138206203445","277426113604700320226640370339464875969","224073098799518807534439583580195025982","277799715264317802547554905594295190981","69766740924398317048985757092906988687","9258448562879469826800135837157866163","67685786581247361914164379316968714543","335121323459318878769032781252737492606","56176108492806206758653613047189306399","46448691155051429913837698490169783490","137818110993031914681022745155221203250","226265166572479949962426400594048762576","263854824677667308487289379092033183235","232681274844331593727509350370934874354","85257053928184904995540262364930371381","97570682812361327442087369687828058460","283893293534886127529842917545357236792","63383459411301384618382738593679827951","47826509394137761444991103031010664395","80759312836081262652976169223913715549","167231120463283927081697417400470149831","326296339692621783594110989552353521330","230669975957801428842095891565483948769","294489062481457862216672575248622591546","267800640272577539095176257522258433107","286496018352255679065067341198423027690","143265481973897052353936616136323947421","241106193424436053029814923603389799986","61723805702566551906274689542705963352","18286118496551250221585521304362313641","113422437253639430297380905224078759387"],"threshold":0.9},"id":"CVE-2026-64609-f58dbe6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c"},{"target":{"file":"java/fory-core/src/test/java/org/apache/fory/xlang/MetaSharedXlangTest.java"},"deprecated":false,"digest":{"line_hashes":["240049121024411553271734155943119130085","178356591748096831559895654842637411834","197859193199204822526499658056515984232","53167391963895840078396220737434674326","291720405293694141617225076172516337886","316311451020540998924902318435102526300"],"threshold":0.9},"id":"CVE-2026-64609-f9bad428","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64609.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}]}