CVE-2026-60080
HIGH
CVSS 7.3
apache_fory
Verified Advisory
Use-after-free in Apache Fory Rust deserialization (CVE-2026-60080)
Denial Of Service
Apache
Deserialization
Use After Free
Memory Corruption
Apache Fory
Apache Software Foundation
A use-after-free vulnerability exists in the Rust deserialization logic of Apache Fory (fory-core). A crafted Fory payload can trigger undefined behavior, a process crash, or potential memory disclosure. Users are recommended to upgrade to the fixed version.
Affected versions:
- Apache Fory (fory-core) 0.13.0 through 1.3.0
We recommend updating to: 1.4.0.
CVSS 7.3 · our assessment: this_week
Reference: https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy
Details: https://vuln.today/cve/CVE-2026-60080
Verified by vuln.today against published advisories.
Affected versions
- – Apache Fory (fory-core) 0.13.0 through 1.3.0
Fixed in: 1.4.0
More advisories for apache_fory
- CVE-2026-71558 – Heap type confusion in Apache Fory C++ polymorphic deserialization (CVE-2026-71558)
- CVE-2026-48207 – DeserializationPolicy bypass in Apache Fory PyFory ReduceSerializer (CVE-2026-48207)
- CVE-2026-64609 – Out-of-bounds read in Apache Fory zero-copy Java deserialization (CVE-2026-64609)
- CVE-2026-64608 – Heap type confusion and out-of-bounds read/write in Apache Fory C++ (CVE-2026-64608)
- CVE-2026-64606 – Class-registration bypass in Apache Fory Java lambda deserialization (CVE-2026-64606)