What is the CVSS score of CVE-2026-60080?

CVE-2026-60080 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Apache Fory are affected by CVE-2026-60080?

Apache Fory, a Rust serialization library used by applications processing untrusted data, contains a use-after-free vulnerability in versions 0.13.0-1.3.0 that enables remote memory disclosure and…

How to fix or mitigate CVE-2026-60080?

Within 24 hours, identify all applications and infrastructure components using Apache Fory versions 0.13.0 through 1.3.0, prioritizing services deserializing untrusted external data. Within 7 days, upgrade all affected systems to Apache Fory 1.4.0 or later, completing functional testing in non-production environments before production deployment. Within 30 days, verify complete inventory coverage, confirm all systems meet the minimum patched version, and implement version monitoring to prevent regression.

Apache Fory CVE-2026-60080

EUVD-2026-46174 HIGH

Use After Free (CWE-416)

2026-07-21 apache

GHSA-8g3p-5q43-955w

Denial Of Service Apache Deserialization Use After Free Memory Corruption Apache Fory Apache Software Foundation

7.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Untrusted deserialization gives an unauthenticated network vector (AV:N/PR:N); UAF yields limited memory disclosure, corruption, and crash, so C/I/A each Low.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 17:22 NVD

7.3 (HIGH)

Analysis Generated

Jul 21, 2026 - 12:01 vuln.today

CVE Published

Jul 21, 2026 - 10:54 cve.org

HIGH

DescriptionCVE.org

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

AnalysisAI

Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let remote attackers submit a crafted Fory-serialized payload that triggers a use-after-free, causing undefined behavior, process crashes, or leakage of adjacent process memory. The flaw affects any service that deserializes untrusted Fory data using the Rust implementation, and Apache has published a fixed release (1.4.0). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile), but the network-reachable, unauthenticated attack surface makes it a meaningful hardening priority for exposed services.

Technical ContextAI

Apache Fory (formerly Apache Fury) is a cross-language, high-performance serialization framework used to encode and decode objects for RPC, caching, and data-pipeline transport across languages including Java, Python, C++, Go, and Rust. This issue is a CWE-416 use-after-free in the Rust deserialization logic: while reconstructing objects from an incoming binary payload, the deserializer references memory that has already been freed, so a maliciously structured payload can steer the parser into reading or operating on a dangling pointer. Because deserializers by design process attacker-controlled bytes, memory-safety defects in this layer are directly reachable by anyone who can supply a payload. The single CPE cpe:2.3:a:apache_software_foundation:apache_fory:*:*:*:*:*:*:*:* covers all affected Fory releases, and the confirmed impacts (crash, undefined behavior, potential memory disclosure) are the classic consequences of a UAF in a native/Rust unsafe code path.

RemediationAI

Vendor-released patch: upgrade Apache Fory to version 1.4.0, which fixes the use-after-free per the Apache advisory (https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy and https://seclists.org/oss-sec/2026/q3/193). Upgrading is the primary and recommended action since it is a clean fixed release. If you cannot immediately upgrade, the effective compensating control is to stop deserializing untrusted Fory payloads: restrict the deserialization endpoint to authenticated, trusted producers only, and place network controls (mutual TLS, allowlisted source, or an internal-only network segment) in front of any service that accepts Fory input, accepting the trade-off that this narrows legitimate integrations. Additionally validate or size-limit inbound payloads at the application boundary and, where feasible, isolate the deserializing process (separate low-privilege service, sandbox, or container with restricted memory access) so a crash or memory disclosure is contained - the side effect being added operational complexity and latency. These are stopgaps only; none fully eliminate the UAF, so schedule the 1.4.0 upgrade.