Use After Free

Apache Fory is vulnerable to Use After Free. The vulnerability is due to a use-after-free flaw in the Rust deserialization logic, where a crafted Fory payload can trigger undefined behavior, leading to process crashes or potential disclosure of sensitive memory contents...

CVE-2026-71560

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-71558

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71559

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

CVE-2026-71559

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

EUVD-2026-54423

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

CVE-2026-71559 Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

CVE-2026-71559

The Go implementation of Apache Fory is vulnerable to a deserialization of untrusted data flaw (CVE-2026-71559). An attacker can provide crafted data containing malformed type metadata , which triggers an uncaught panic in the Go meta-string decoder, resulting in a denial of service (DoS) . This ...

CVE-2026-71558 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71558

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71558

A heap type confusion vulnerability exists in Apache Fory C++ versions 0.14.0 before 1.5.0 . The root cause is a failure to properly validate type compatibility during polymorphic smart-pointer deserialization , which allows a crafted input payload to force the system to treat an incompatible obj...

EUVD-2026-54422

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71558 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71560

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-71560 Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-71560

The Apache Fory C++ library (versions 0.14.0 to 1.5.0 ) is vulnerable to an out-of-bounds heap read during the deserialization of structs containing tagged integer fields . A crafted input payload can trigger this flaw in the tagged integer fast-path deserializer, potentially leading to informati...

PT-2026-68891

Name of the Vulnerable Software and Affected Versions Apache Fory C++ versions 0.14.0 through 1.4.x Description An out-of-bounds read issue exists during the deserialization of structs containing tagged integer fields. A crafted input payload can trigger an out-of-bounds heap read within the tagg...

PT-2026-68890

Name of the Vulnerable Software and Affected Versions Apache Fory versions 0.16.0 through 1.4.x Description Deserialization of untrusted data in the Go implementation allows an attacker to cause a denial of service. This occurs when crafted data containing malformed type metadata is supplied,...

PT-2026-68889

Name of the Vulnerable Software and Affected Versions Apache Fory C++ versions 0.14.0 through 1.4.x Description A heap type confusion issue exists in C++ deserialization. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an obje...

CVE-2026-71558: Deserialization of Untrusted Data

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...