Not rated
CVE-2026-71559 Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a…
Description
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Fory 0.16 | 0.16.0 → < 1.5.0 | 1.5.0 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Fory
The 11 CVEs of Apache Fory →
CVE-2026-71558
Heap type confusion vulnerability in Apache Fory C++ deserialization
Not rated
CVE-2026-71560
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization
Not rated
CVE-2026-60080
Use After Free vulnerability in the Rust deserialization logic of Apache Fory
Not rated
CVE-2026-64606
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java…
Not rated