What is the CVSS score of CVE-2026-71559?

CVE-2026-71559 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Fory are affected by CVE-2026-71559?

The Go implementation of Apache Fory (versions 0.16.0-1.5.0) is vulnerable to an unauthenticated denial-of-service attack that can crash affected services and disrupt operations.. A patch is available.

How to fix or mitigate CVE-2026-71559?

Within 24 hours: Identify all Apache Fory Go implementations running affected versions (0.16.0-1.5.0) in your infrastructure using asset discovery or container registry scans. Within 7 days: Apply the vendor-released patch from the Apache Fory project to all identified instances, test functionality in a staging environment, and roll out to production with change management approval. Within 30 days: Implement network-level controls such as rate limiting or authentication proxies to restrict unauthenticated access to Fory services, and review patch management policies to expedite future Go component updates.

Apache Fory CVE-2026-71559

EUVD-2026-54423 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-07 apache

GHSA-63m9-m4r7-4qjg

Denial Of Service Apache Deserialization Apache Fory Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-delivered crafted payload requires no authentication or interaction; impact is strictly availability via process crash, with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 18:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 18:22 NVD

7.5 (HIGH)

Patch available

Aug 07, 2026 - 10:16 EUVD

Analysis Generated

Aug 07, 2026 - 09:45 vuln.today

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic.

This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.

AnalysisAI

Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected services by sending crafted serialized data containing malformed type metadata, triggering an uncaught Go runtime panic. Affected versions span 0.16.0 through 1.5.0 (exclusive), while all non-Go language implementations remain unaffected. No public exploit code or active exploitation (CISA KEV) has been identified; the EPSS score of 0.18% (8th percentile) corroborates low current exploitation activity despite the high CVSS base score.

Technical ContextAI

Apache Fory is a high-performance cross-language serialization framework; CVE-2026-71559 is isolated to its Go implementation. The root cause is CWE-502 (Deserialization of Untrusted Data): when the Go deserializer processes incoming byte streams, it parses embedded type metadata to reconstruct objects. A specially crafted payload can supply structurally malformed type metadata that the parser does not defensively validate, causing an uncaught panic - the Go runtime's unrecovered exception mechanism - which terminates the process. The CPE cpe:2.3:a:apache_software_foundation:apache_fory:*:*:*:*:*:*:*:* covers all platform/edition variants, but the description explicitly limits impact to the Go implementation. This class of flaw is common in serialization libraries that trust type hints embedded in the serialized stream.

RemediationAI

The primary fix is to upgrade to Apache Fory 1.5.0, which resolves the uncaught panic by adding defensive validation of type metadata during deserialization. The patch is confirmed available per the Apache project advisory at https://lists.apache.org/thread/f28bw002p32yt723rvv3dcwdkljys8r3. If immediate upgrade is not possible, the most effective compensating control is to restrict what data sources the Go Fory deserializer processes: enforce that only internally generated or cryptographically authenticated serialized payloads are accepted, rejecting any externally supplied input before it reaches the deserialization layer. Placing an API gateway or input validation proxy in front of endpoints that invoke Go Fory deserialization can enforce this boundary with minimal application changes, though it adds operational complexity. There is no indication of a configuration flag to disable the vulnerable type-metadata parsing path within the library itself.