← All advisories

High severity7.3NVD Advisory· Published Jul 21, 2026· Updated Jul 27, 2026

CVE-2026-60080

CVE-2026-60080

Description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Affected products

2

Apache/Fory2 versions
cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*range: >=0.13.0,<1.4.0
- (no CPE)range: 0.13.0 - 1.3.0

Patches

Vulnerability mechanics

References

2

www.openwall.com/lists/oss-security/2026/07/21/3nvdThird Party Advisory
lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvynvdVendor Advisory

News mentions

0

No linked articles in our index yet.