Executive Summary
A critical deserialization of untrusted data vulnerability (CVE-2026-64606) has been disclosed in Apache Fury, the high-performance multi-language serialization framework. The flaw carries a CVSS score of 9.8 and allows an attacker to bypass class-registration safety checks during Java lambda deserialization, potentially achieving arbitrary code execution on the target system.
CVSS Score: 9.8 (Critical)
The vulnerability exists in Fury's Java lambda deserialization path. When deserializing lambda objects from untrusted sources, only the lambda capture class undergoes deserialization — the class-registration checks that normally enforce which types are allowed to be deserialized can be circumvented. A patch is available in Apache Fury 1.4.0.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-64606 |
| CVSS Score | 9.8 (Critical) |
| Type | Deserialization of Untrusted Data |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Affected Component | Java lambda deserialization path |
Affected Versions
| Component | Affected Versions | Fixed Version |
|---|---|---|
| Apache Fury | < 1.4.0 | 1.4.0 |
Technical Analysis
Apache Fury uses class-registration allowlists to prevent deserialization of arbitrary classes — a key defense against gadget-chain attacks. However, when deserializing Java lambda objects, Fury only serializes and deserializes the lambda capture class rather than the full lambda. This design quirk means the class-registration check is effectively skipped during lambda deserialization.
An attacker who can supply crafted serialized data to an endpoint using Fury can exploit this gap to inject unexpected classes through the lambda capture path, bypassing the type whitelist entirely.
Attack Flow:
1. Attacker crafts malicious serialized payload embedding a lambda capture
2. Payload targets a Fury-deserialization endpoint (RPC, queue, API)
3. During deserialization, the lambda capture class bypasses registration checks
4. Attacker's class is instantiated — gadget chain executes arbitrary code
5. Full code execution on the server process
Why Class-Registration Matters
| Protection | Normal Path | Lambda Path (Vulnerable) |
|---|---|---|
| Class-registration check | Applied | Bypassed |
| Attacker-controlled class | Blocked | Allowed |
| Gadget chain execution | Prevented | Possible |
Immediate Remediation
Step 1: Upgrade Apache Fury
<!-- Maven — upgrade to 1.4.0 -->
<dependency>
<groupId>org.apache.fury</groupId>
<artifactId>fury-core</artifactId>
<version>1.4.0</version>
</dependency>// Gradle
implementation 'org.apache.fury:fury-core:1.4.0'Step 2: Validate Deserialization Sources
Even after patching, restrict where serialized data originates:
// Only deserialize from trusted sources
// Never deserialize raw user-supplied bytes without validation
Fury fury = Fury.builder()
.requireClassRegistration(true) // Enforce allowlist
.build();Step 3: Apply Defense-in-Depth
- Network segmentation: Prevent untrusted callers from reaching Fury-backed services
- Input validation: Validate serialized data length and origin before deserialization
- Monitoring: Alert on unexpected class-loading events in JVM logs
If Immediate Upgrade Is Not Possible
- Disable lambda serialization in Fury configuration if your application does not require it
- Firewall deserialization endpoints to trusted internal callers only
- Enable JVM class-loading auditing via Java agents (e.g.,
-javaagent:serialkiller.jar) - Deploy a WAF rule to reject oversized or anomalous serialized payloads
Detection Indicators
| Indicator | Description |
|---|---|
| Unexpected class loading in JVM logs | Attacker-supplied classes being instantiated |
| Anomalous outbound connections from JVM | Post-exploitation callback or exfiltration |
| Unusually large serialized payloads inbound | Gadget chain padding |
| Process spawning from JVM parent | RCE achieved via Runtime.exec() or ProcessBuilder |
Post-Remediation Checklist
- Confirm Fury 1.4.0 is deployed across all services
- Audit all deserialization endpoints for untrusted data sources
- Enable
requireClassRegistration(true)explicitly in Fury builder - Review service mesh rules to restrict which callers can send serialized data
- Check JVM logs for any historical anomalous class-loading events
- Update dependency scans (Dependabot, Renovate) to flag Fury < 1.4.0