CVE-2026-64609
- Source
- https://cve.org/CVERecord?id=CVE-2026-64609
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64609.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64609
- Published
- 2026-07-21T09:34:57.010Z
- Modified
- 2026-08-12T16:41:43.070562Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
- Summary
- Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
- Details
-
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
- Database specific
{ "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "0.11.0" }, { "fixed": "1.4.0" }, { "introduced": "0.5.0" }, { "fixed": "0.11.0" } ] }, { "source": "DESCRIPTION", "extracted_events": [ { "introduced": "0.5.0" }, { "fixed": "1.4.0" }, { "fixed": "0.11.0" } ] } ], "cwe_ids": [ "CWE-125" ], "cna_assigner": "apache", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64609.json" }- References
Affected packages
Git / github.com/apache/fory
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64609.json"
vanir_signatures
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"177363880195282771255642702297707353069",
"57400381701205228328367951400608269918",
"267928844915268583191244861122159188898",
"8781303066409428664158149406778788962",
"216109104940456622477779787452491735607",
"6730570837733545500291220133931311744",
"91167477035033247104690568278398425014",
"28154903035585858640426722688750183913",
"326229802816129590441944998913510309265",
"238831395903958091338890603954000341537",
"2193499928271380864558503268849757234",
"33765086267650442712366364010043433541",
"153799106857375362461120125737227541154",
"338136925246914388929467459741302531122",
"332519046981785276116278828421170578683",
"198728866793584960142803048599093538667",
"137616428104686158183686447876650677577",
"286926144956515776514223570490708356012",
"13310967999975964718425968734519329210",
"335902213056213830552097445097275951941",
"313722166710297815546076155121942553163",
"193236632528456135153419906951518357318",
"154570192737377649758440338286093091175",
"238856195202721201324998714454945482288",
"213976981681802063438209491039506316768",
"182835219104844604846520567836297989199",
"56445120422370432107297528310517788777",
"140368451182316025590194468121559131774"
]
},
"target": {
"file": "java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-01fc652f",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "42451626266369789638695224143987010258",
"length": 1625.0
},
"target": {
"function": "buildDecodeExpression",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-099662b9",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "57502227135372266915665569455283082831",
"length": 5062.0
},
"target": {
"function": "inferField",
"file": "java/fory-format/src/main/java/org/apache/fory/format/type/TypeInference.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-0c32901c",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "64862335666524616398601377012350108103",
"length": 45.0
},
"target": {
"function": "encodedType",
"file": "java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-1567011a",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "244224884963891280645824907198363590432",
"length": 1881.0
},
"target": {
"function": "buildFieldType",
"file": "java/fory-core/src/main/java/org/apache/fory/meta/ClassDef.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-158eb7c2",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "161539031762898585129588817538786868139",
"length": 1212.0
},
"target": {
"function": "isSupported",
"file": "java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-15f86470",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "285999295017721204352138146955089529469",
"length": 1448.0
},
"target": {
"function": "buildClassInfo",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/XtypeResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-224c9fa9",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"128376195914510865089369049632660483900",
"254523651412088333825579986646957411272",
"63711029647093202937540714316216222805",
"94269900221290050349726351856014925111",
"3567222832444109133588993495490721011",
"314505024564639013566216199921435846045",
"177387284766167113270278849552872048782",
"270074171582006727299655683384822285693",
"84196879195447044516691702548973029107",
"28154696943350677872770252605497490206",
"204960662178788800207404917261810654362",
"333780576253508963834316297073067246567",
"314254777766523131017641642467561416683",
"4026155326875979157912289725638251167",
"128391430005365186298984401626083934472",
"57844838590826776471487337818779259761",
"217309634030833027408908633022771588610",
"250733954389632432680552628763307016215",
"49804037694185556953550762139898046577",
"303412450854482676605558640982768785894",
"14113927542139008042532492141185885232",
"311123815683340001857603548108054403731",
"196085794903732001118884369120059921593",
"319838937940713976548021315147581335481",
"34283346495987518718302036333368351799",
"175896832266881769317063835172389960350",
"146406441205860667147716347881976719532",
"144014100042240532945827016513069689469",
"91773826475512539143063893098025488796",
"295148160528929648648331071605771930047",
"280694034396900870590462594041289644131",
"146915409640185665205097398022741665930",
"287367126425361977578759324814237108652",
"160619241904525633485072526636868065629",
"147614427327713115662772000648504733482",
"159137556278201095255713742099594328176",
"93632072380949358855627360801627419248",
"158995191819191812820568098922399395273",
"321691290822507766481071743852849344054",
"293053055722750326948680592117562206744",
"198229292217064141816853630962755523524",
"268191775749315638210280275266697946169",
"225025566040806177965040624280598528462",
"50924055608374450595048008013126742680",
"292506716949143079085295859382438489652",
"227963408642751315468859647482513937835",
"129509610368625439867334230655348340620",
"18244000515648236543207398115172488212",
"253562700411624176747999102830798027932",
"30425380489070326989377360254519306143",
"102290930141451228410540883939325048652",
"239602258571777583556004018533669969970",
"43426142835678480996635914106713565766",
"245063218586109855902808130158693539033",
"131978437740218827411283215754977826538",
"209698914186207654439777691106014721677",
"214498868715723226239619971519002422671"
]
},
"target": {
"file": "java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-2306c4d9",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "39710749106385790515369426341403061663",
"length": 975.0
},
"target": {
"function": "register",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-26d4ebab",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "117570666171722528709087159669421315121",
"length": 481.0
},
"target": {
"function": "toTypeToken",
"file": "java/fory-core/src/main/java/org/apache/fory/meta/ClassDef.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-315c8894",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "215855599549723564937642089664411670817",
"length": 4333.0
},
"target": {
"function": "serializeFor",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-39a6aaad",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204126710891923963864859384180663628891",
"304043332886506038783437960514487331353",
"193250636797402252997933709395763724083",
"23578324719450857808192847738457593119",
"86214691474558800446402344626113569418",
"307341713504808257282916939506392408373",
"190220099594319248092455816175157893593",
"46314709150845473022920351573913068300",
"324655353945924831763140347825828834174",
"77902719094785947751385039904563204574",
"94872471544479206690745845118304470521",
"273671238733723338542460594163487175156",
"314538087240792128608613173527495981582",
"270446884649083052218201219430617348533"
]
},
"target": {
"file": "java/fory-core/src/main/java/org/apache/fory/type/CustomTypeRegistry.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-46e00543",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "159879472334664447605829541867958008470",
"length": 354.0
},
"target": {
"function": "writeClassInternal",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-46f24599",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65127933177075422404074507562800404445",
"length": 1110.0
},
"target": {
"function": "listBeansRecursiveInclusive",
"file": "java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-4e8e1495",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112872382249674849585139489858030656014",
"315498983511793526534800895674040181144",
"254860430178737207678513114312008530530",
"215838929714933749373670169659017724720",
"54171691321487945063552587322101755616",
"263350101921321932495107776718211625382",
"53818198820614618293664688845459375942",
"151664087317715513502756302191276502477",
"75323024397555384353369863517786955198",
"295645846483097110336143292029397499370",
"289535441946452471089676181925437696547"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeHandler.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-51cbf284",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "323533300234616702103469082259301568275",
"length": 1101.0
},
"target": {
"function": "accept",
"file": "java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeEncoderRegistry.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-52c2f1d6",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "19441292333554383320461173875341715609",
"length": 435.0
},
"target": {
"function": "deserializeForCollection",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-5f0faf39",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"127290275288847601020487886401940127050",
"77035765733250553951956088324556272736",
"157212076880784298797254226352418912264",
"19088433916083246296537697377442779977"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayDataForEach.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-64c33a64",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"53468411064354626692101253226368638782",
"1823460947581469900262894662307221626",
"49917847013776937029508080003678945695",
"226727652721210893092188403631026807545",
"188914735713465246979554147870517492791",
"225300872844652805128035214214015670226",
"167317080891620314003581242048894935111",
"146062281232003313723477375955039299103"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-652f08dc",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"214828719082474293742671622392862839712",
"188754650296935162173052717888294396302",
"151106443547447572410350175291723788826",
"227549233894693055246206714103169428372",
"40514199685546084024414756060816179570",
"179227681237092516613927473781687056516",
"230161258845022054275471885193198999175",
"309910709185364670627141355649019763735",
"278211964857334855540857057289631451444",
"26190485595635263498596904487797626920",
"278480514794015872309525848262999024816",
"250481531357687580907609342253500145486",
"293222973606157155555625159357963018314",
"79643729532061177606930755228974100607",
"130518108832279050445318806189233377298",
"149738715167571367944380690294219769105",
"296448714140738297748369687904637004942",
"281492406805225521683053959141000619136",
"45717092642420109503030376349116274679",
"67190366628643992044257594813707967863",
"209395406132555238946939339819160742882",
"266034625519105560115632639454680191618",
"28355889551484502350659006627519269983",
"323553881255286208607478889276179010861",
"305886810588871631875077145689870503047",
"24754764183591905225645339868001758216",
"138725674194163311772356170083603556828",
"226581271432277160670721145436967863345",
"301106366956569546747972769806223719953",
"82424579476189590868237125914541928091",
"266039040299757088973811342878946146687",
"314596663582849983063796263950324316139",
"272417304289299367168326192945258401608",
"36935001515025120601957046921612359087"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/type/TypeInference.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-7902f870",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "37900811841876704036154387995768452490",
"length": 846.0
},
"target": {
"function": "register",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-79cb8a0d",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"254801131045325476032698240568439170788",
"85057182162501631264473236459180433248",
"71334589970451180819182512716997269257",
"207932222726691037985340832208982573142",
"224234504249652924107217689408853169776",
"302462078041103014881898882076935782188",
"308295519162224128065734619001778842234",
"309675991438554067507586657240718599328"
]
},
"target": {
"file": "java/fory-core/src/main/java/org/apache/fory/meta/ClassDef.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-7d586c49",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "38915698567733575521963922919017710598",
"length": 865.0
},
"target": {
"function": "populateBytesToClassInfo",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-7e3f9e8f",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "273999064854575272482747310177375976934",
"length": 342.0
},
"target": {
"function": "arrayDeserializeForCollection",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-7e5d362d",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"111460061501546647406582184363852520504",
"300588875233591183859711495287184249012",
"36957338686832202119363278278997629766",
"98491843637907615890380114631517934196",
"123782639160256095731344818134660515929",
"82502184198480883494919377376227822236",
"4466033812228245068280995422332239262",
"220965623606895933368023173534504051414",
"208196610233825096914360841165820463049",
"170027169715683051081537019473244344158",
"208291698084930560667063268346373202896",
"84257212446205692876771920737338672429",
"176224921825474159707752629401847346671",
"62767168201274214358491243488075419869",
"8359948299865572415566111032408765896",
"273333999839275478205548609112019234118",
"260938501707732613096123385981356576227",
"48902929647720362647844396956706200542",
"334943010135464500036033100362636188267",
"166120102303150338796115181046391215623",
"72193641832656809620132493764187612714",
"319540614313572531431152545284080753903",
"136446575903440197814745048685796402942",
"191505932036793593614027950374104457630",
"153243857435429877964346068624446671379",
"140313657270808172524106758680466616451",
"179022568482453329621057727351626820331",
"322325363528143941653306056364957818375",
"111958298255095661902548623330517078258"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/CustomCodec.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-838dcdda",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159353619880263815079858494251203511706",
"263798750388740425247295128324558790195",
"204858175704319258791757390166451383659",
"120488333963936941095971953110103301121"
]
},
"target": {
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/XtypeResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-83bf4764",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "192490532957935979374861400591184127601",
"length": 985.0
},
"target": {
"function": "buildEncodeExpression",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-89e8470d",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "223590185313960708763450950676331550319",
"length": 1021.0
},
"target": {
"function": "isBean",
"file": "java/fory-core/src/main/java/org/apache/fory/type/TypeUtils.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-8b2ce6ad",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "64862335666524616398601377012350108103",
"length": 45.0
},
"target": {
"function": "encodedType",
"file": "java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-8d2cf208",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "111617422972431918913182307586908366683",
"length": 1911.0
},
"target": {
"function": "deserializeForArray",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-9369321a",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "130529491778384829151104007917921651630",
"length": 1050.0
},
"target": {
"function": "addDecoderMethods",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-98aabd10",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "207890100621658045228545247722998021376",
"length": 92.0
},
"target": {
"function": "setClassInfo",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-a0dd2483",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "39897848392374077419923549656423776681",
"length": 620.0
},
"target": {
"function": "addSerializer",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-a15b0cf4",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "278140816873280359404378510860499597272",
"length": 2388.0
},
"target": {
"function": "deserializeFor",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-a28324c6",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "299733918788732979238816298421678870022",
"length": 1382.0
},
"target": {
"function": "serializeForArrayByWriter",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-a7bf8447",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "83353973451327832724793666790294968792",
"length": 673.0
},
"target": {
"function": "ArrayDataForEach",
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/ArrayDataForEach.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-ad6f427c",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "81857687506232180722923542276325749146",
"length": 901.0
},
"target": {
"function": "createSerializer",
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-b820aaf3",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "284157324134793945237518830757653274395",
"length": 107.0
},
"target": {
"function": "getField",
"file": "java/fory-format/src/test/java/org/apache/fory/format/encoder/CustomCodecTest.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-ba6f7231",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"187377162775745741327637036157163662705",
"250053219074730181063501425198091836597",
"230701710808174160380150977994247515078",
"99563890228891780729506109037486020316",
"142934390129700535078819556806409356573",
"318230937781540942883022935618267191436",
"259556775199416297117296320215378220494",
"160817509304320979913903882675448182184"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeEncoderRegistry.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-bbf49db4",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"119229906201455697690713978276896101788",
"285991542060345326877288048413612223347",
"26601012244152008113907810016570880166",
"167064327355242847448764458285601114905",
"292669035786754136962036372766132986414",
"31649242437563334563458788944994988638",
"169959512415459349657727599519917292393",
"131917753493023716328657326831898058957",
"293616791129380712046925985442953741730",
"310241999376683957283874345507607745289",
"200040783285870912453847109244142373876",
"30131816221253982728462302443350667223",
"40532142614670600148656322200581569530",
"232097299177140840154921844465406051615",
"322042340315687823551804594300940655490",
"117934037391636976438623910813291168172",
"236237278115396450982448149482533950148",
"306480521493604119028051144661882103497",
"100757263930863453612302250611368638262",
"76990823304255339826909655006540583929",
"141431962222020687179169444831436038931",
"54835740587243708398004075104297003880",
"191900368532931402389598655205770711",
"132795518955332835390462340656174736670",
"20315219711250116524566328134501530755",
"330532867994880608397334025596483995683",
"116111904702594821285792289188971256971",
"207013377186937778570561796960782667166",
"21432311923900181694758321936532936764",
"16485871063715614633951347919487063586",
"86001692510480381341463891062521330302",
"207154561018905570390423873650682860522",
"228374897267865425241679881127137480267",
"192234006688157784135042452970003971521",
"294430265102435213924100930134126746484",
"265981571278442209778616474725568949833",
"228374897267865425241679881127137480267",
"276800187578005415761492709193000484239",
"54142940307047321642150048946439990926",
"121913641119824678401503234904174468665",
"6601259981609045837043142650584923688",
"275940137506218523774717405172852768329",
"210213466204348314022261485038247576305",
"293616791129380712046925985442953741730",
"7893981196670010123635010538190886314",
"85970813340141970391928592214284614127",
"332283747052437452108663666161264957965",
"49166585094189416990505173024177791224",
"97065260656286151774918819744595203016",
"254843633116227868265124655829947629231",
"17045757656603560483698449872350252398",
"325920831122045343240305276478889754552",
"102825105902882101990346824885583038290",
"10622105551449514438773712810887277778",
"259776063338631780896601241147558566494",
"76661171045476159975670550757675996086",
"190190273326697099538503506048575194775",
"283575423399535239723486875314372446325",
"211014882821958746888091824861108216454",
"109718821004135155313416911210978659997",
"122473295207028651583568311095699473952",
"73260740273098171432928484813185462151",
"297070397922911318439174093925966139317",
"27216759405281806097090359958248762751",
"87237574895769033597169446344334837277",
"101259755285747009750196002963590980234",
"192305450784481470900443167558239509962",
"107167009415012590233145468221405340453",
"35280209259583704694945619756792534226",
"127883400547639856002735875503070277063",
"41932210954110002341784160578922052026",
"272331958285261734973834314946345619302",
"149596771833404514464383720937227599462",
"251446906334411881286161185767714692539",
"183367544454087916104895055985191057670",
"60205958770651110267668738285941124699",
"142013354363186981120184725032630321604",
"240203039790741084194819368027767284888",
"202543274536194668395150157982686125121",
"168122116656267311066519715608057255387",
"38121736744179936334404194067487759597",
"85103118569700450482023317808247115775",
"39492881937860286480260901089837769589",
"114138970059897039949874240605217362751",
"36217734701178304884595038485624290494",
"130682331884913968778681776838614456707",
"228959836036138983000994098194913584410",
"116493448915597932864469126942175442325",
"215718222089647643109981841614481308281",
"140472034006848413167214191382091827459"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/BaseBinaryEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-c7a28229",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"function_hash": "320078457426537591899968086352495990217",
"length": 4293.0
},
"target": {
"function": "genCode",
"file": "java/fory-format/src/main/java/org/apache/fory/format/type/CustomTypeEncoderRegistry.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-e6cb4d0e",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"151069242058143991456563574004559928831",
"160897113438072771680024722565696840564",
"277959594692690425172593118910162022269",
"289811221658585349917560303423688048634",
"48974279877259636306485733673067557020",
"329998960453271398919816897900551278434",
"315692480328124092644642563883898851909",
"36041007274001501435053655981908792425",
"313415352359456740500273241510281204193",
"71013749213930692077871532588752595839",
"198833255783323673337313517378183675400",
"14745833355398784169037195601685873656",
"329692940237025455480519620121840640011",
"272455369102090402911435558878779741631",
"332165731635098400696846777444584559971",
"20480008613965755104966847668576758802",
"316182186805941399825209742624751046130",
"168989903449706602177669455441295505177",
"55484274676108572028876069255370441118",
"234478469724967895259680171152154181033",
"50096557968080300507430744972287983445",
"152737340784757050625526776655903882646",
"22456779680893605215385999716469113304",
"126191531082066035044558511789760037098",
"96395634340213233288902472529707560888",
"338524940449705874926953995671355944682",
"129398664733926739069020261881645654030",
"128336338323801927910544982179838739575",
"156469610314946931596841604583562956122",
"235812722676386941582757174664876341956",
"29291476330833459823381837368227063599",
"187287445502402784615468197364779781947",
"337875126494864465858801868217825676022",
"119620917668925117077438094405950384901",
"165013271755354387567811528687919522749",
"283435946534730870577821330932158695360",
"88482638506107581550759144620690692175",
"118213150722131366740575642636306890850",
"210251879238605875811001968787360287213",
"99041740325291661469613127851339475172",
"34296451464975190409816349484642305411",
"34017892630907288053821458296924833274",
"246630636599104622672958810994314358394",
"196654149937767152923697321776408845594",
"272760847090655094487907452409248867019",
"268654995407702629011586057950079292435",
"176826935306389704017781002390832352597",
"208573319244572890202023769289029932249",
"72212133335473706500420535896330034206",
"46490135998713089561303051262711039752",
"247796873068575226503196518299383969778",
"306704358771870200272529508122838161973",
"201303631860255395429154399848828664117",
"120334259922754409750156720028318871267",
"291918397038410698018883144014433784104",
"15583539670146634319574386598084360379",
"205010110861294163263909043499388531351",
"336667581878475305512992264696802659720",
"190144174437601457817161596411488852826",
"214023200188170166954324304239715608379",
"117095868026967524758816832000985800203",
"331853485865545223815495492218519466262",
"254567980028758509399872555969278614714",
"166943318700544420047953001567764122681",
"259880999385306167407618578460369245280",
"105799921537995592937954542369919341917",
"305335784915979260795476218660174315316",
"209201044519899157363709845472140675247",
"8686154070294529462446488270689330543",
"200689322357214021015594512077845393412"
]
},
"target": {
"file": "java/fory-format/src/main/java/org/apache/fory/format/encoder/RowEncoderBuilder.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-f56e18a1",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"212452144717488038146598384138206203445",
"277426113604700320226640370339464875969",
"224073098799518807534439583580195025982",
"277799715264317802547554905594295190981",
"69766740924398317048985757092906988687",
"9258448562879469826800135837157866163",
"67685786581247361914164379316968714543",
"335121323459318878769032781252737492606",
"56176108492806206758653613047189306399",
"46448691155051429913837698490169783490",
"137818110993031914681022745155221203250",
"226265166572479949962426400594048762576",
"263854824677667308487289379092033183235",
"232681274844331593727509350370934874354",
"85257053928184904995540262364930371381",
"97570682812361327442087369687828058460",
"283893293534886127529842917545357236792",
"63383459411301384618382738593679827951",
"47826509394137761444991103031010664395",
"80759312836081262652976169223913715549",
"167231120463283927081697417400470149831",
"326296339692621783594110989552353521330",
"230669975957801428842095891565483948769",
"294489062481457862216672575248622591546",
"267800640272577539095176257522258433107",
"286496018352255679065067341198423027690",
"143265481973897052353936616136323947421",
"241106193424436053029814923603389799986",
"61723805702566551906274689542705963352",
"18286118496551250221585521304362313641",
"113422437253639430297380905224078759387"
]
},
"target": {
"file": "java/fory-core/src/main/java/org/apache/fory/resolver/ClassResolver.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-f58dbe6c",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240049121024411553271734155943119130085",
"178356591748096831559895654842637411834",
"197859193199204822526499658056515984232",
"53167391963895840078396220737434674326",
"291720405293694141617225076172516337886",
"316311451020540998924902318435102526300"
]
},
"target": {
"file": "java/fory-core/src/test/java/org/apache/fory/xlang/MetaSharedXlangTest.java"
},
"source": "https://github.com/apache/fory/commit/cc91f02d95945c3534920eb075dcff60ce0b435c",
"signature_version": "v1",
"id": "CVE-2026-64609-f9bad428",
"deprecated": false
}
]
vanir_signatures_modified
"2026-08-12T16:41:43Z"