CyberRota Analysis
AI-GeneratedApache Fory versions from 0.5.0 to before 1.4.0 are vulnerable to a critical out-of-bounds read due to improper handling in the readAlignedVarUint() function during out-of-band zero-copy deserialization. This vulnerability could allow attackers to read beyond the allocated memory buffer, potentially leading to information disclosure. Organizations using affected versions, particularly those utilizing the zero-copy deserialization feature, should prioritize upgrading to version 1.4.0 to mitigate this risk.
Original NVD Description
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)