External risk intelligence

Apache Fory Lambda Deserialization Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64606

The vulnerability involves deserialization of untrusted data in a Java library. While this can be reached over a network in some application deployments, library-level vulnerabilities are often buried within application logic or internal processing pipelines rather than being directly exposed as public-facing edge services by default.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Apache Fory, stemming from a deserialization flaw that could allow bypassing security checks during Java lambda deserialization, specifically impacting lambda capture classes. This issue may present a significant risk if the affected technology is used in your environment.

Flaw allows bypassing Java security checks.
Critical risk if affected Java technology is used.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data that bypasses class-registration checks during Java lambda deserialization. This could lead to the execution of arbitrary code, provided the vulnerable component is exposed and the lambda capture class is involved.

Unauthenticated network access required.
Deserialization of untrusted lambda data.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to bypass class-registration checks during Java lambda deserialization, potentially affecting the integrity and behavior of applications using affected versions of Apache Fory. The specific risk depends on how the application handles deserialization and whether it processes untrusted data.

Affected Java lambda capture classes.
Bypass class-registration checks during deserialization.
Potential for unexpected application behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache Flink's Java lambda deserialization may impact application owners and platform teams. The first step is to identify all Flink deployments, determine their exposure and business criticality, and locate the responsible system owners to prioritize remediation efforts.

Application owners should confirm Flink usage.
Verify Flink is not exposed externally.
Plan Flink upgrades during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Fory and how is it used?

Apache Fory is a software library often integrated into Java applications to manage data processing or distributed computing tasks. Developers use it to handle complex operations, such as managing lambda expressions—small, anonymous functions that allow for cleaner, more efficient code. By facilitating how these functions are processed, Fory helps applications scale and perform tasks across various environments, acting as a functional component within larger Java-based software architectures.

What does deserialization of untrusted data mean for CVE-2026-64606?

This vulnerability is classified as CWE-502, which occurs when an application takes data from an untrusted source and reconstructs it into an object without sufficient verification. In this specific case, the flaw allows an attacker to bypass security checks that normally confirm the validity of classes during Java lambda deserialization. By tricking the application into accepting unauthorized classes, the process may lead to the execution of unintended code or commands.

How can an attacker trigger this vulnerability?

An attacker triggers this bug by sending specially crafted, untrusted data to an application that processes it using the affected Apache Fory library. The vulnerability specifically involves lambda capture classes, meaning the attack requires the application to perform deserialization on data involving these specific Java components. Simply accessing the network is not enough; the application must be actively configured to deserialize incoming data that leverages these vulnerable lambda processes.

Is my system at risk if it uses Apache Fory?

According to Halo Surface Signal, risk depends on how your application uses the library. While the flaw is serious, library-level vulnerabilities are often buried deep within internal processing pipelines rather than being directly exposed as public-facing edge services. If your application processes untrusted network data using Fory, the risk increases, but many deployments may be shielded if they operate strictly within internal, non-public environments.

What are the first steps to address this CVE?

Start by identifying all services in your environment that utilize Apache Fory versions earlier than 1.4.0. Coordinate with your engineering teams to confirm if these services handle deserialization of untrusted data, as this is the primary path for the vulnerability. Once identified, prioritize scheduling an upgrade to version 1.4.0, which contains the fix for this issue, during your next planned maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.