Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Apache Fory: Out-of-bounds heap read when deserializing data

CVE-2026-71560 · published 28 days ago
Summary

Apache Fory versions from 0.14.0 to 1.4.9 are at risk of exposing sensitive information or crashing if given a specially crafted input. To fix this, update to version 1.5.0 if you use Apache Fory C++. If not, you're safe.

What to do
  • Update apache software foundation apache fory to version 1.5.0 or later.
  • Update apache fory to version 1.5.0 or later.
Affected software
VendorProductAffected versions
apache software foundation apache fory < 1.5.0
apache fory >= 0.14.0, < 1.5.0
cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*
Original advisory text
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer field...
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.

This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.


Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
References
Severity
9.1 Critical
Exploitation
EPSS <1%
Type
CWE-502Deserialization of Untrusted Data
CWE-125Out-of-bounds Read
Timeline
Published7 Aug 2026
Updated3 Sep 2026
First seen7 Aug 2026
Sources
CVE-2026-71560 · NVD
CVE-2026-71560 · MITRE
Monitor software like this
Free during beta