PUBLISHED
2026-07-21 10:16
MODIFIED
2026-07-21 10:16
EPSS (Prob. Exploit)
0.78%
Top 44.1%
> DESCRIPTION
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-125: Out-of-bounds Read - The product reads data past the end, or before the beginning, of the intended buffer.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
> HISTORIQUE DES MODIFICATIONS
Première apparition
21/07/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-125: Out-of-bounds Read - The product reads data past the end, or before the beginning, of the intended buffer.
Total des modifications: 1
Dernière mise à jour: 3 months ago