CVE-2026-60080

HIGH 7.3

Apache Fory: Rust MetaString heap use-after-free

CVSS Score

7.3

EPSS Score

0.2%

EPSS Percentile

7th

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

CWE	CWE-416
Vendor	apache software foundation
Product	apache fory
Published	Jul 21, 2026
Last Updated	Jul 22, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache fory

Be the first to know when new high vulnerabilities affecting apache software foundation apache fory are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Fory

0.13.0 ≤ 1.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy openwall.com: http://www.openwall.com/lists/oss-security/2026/07/21/3

Credits

🔍 Nguyen Van Hiep (@hypnguyen1209) from MBBank