Not rated
CVE-2026-60080 Use After Free vulnerability in the Rust deserialization logic of Apache Fory
Description
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Fory 0.13 | 0.13.0 → 1.3.0 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Fory
The 11 CVEs of Apache Fory →
CVE-2026-71559
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a…
Not rated
CVE-2026-71558
Heap type confusion vulnerability in Apache Fory C++ deserialization
Not rated
CVE-2026-71560
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization
Not rated
CVE-2026-64606
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java…
Not rated