CVE-2026-71559

UNKNOWN 0.0

Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

CVSS Score

0.0

EPSS Score

0.2%

EPSS Percentile

8th

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

CWE	CWE-502
Vendor	apache software foundation
Product	apache fory
Published	Aug 7, 2026
Last Updated	Aug 7, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache fory

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache fory are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Fory

0.16.0 < 1.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/f28bw002p32yt723rvv3dcwdkljys8r3 openwall.com: http://www.openwall.com/lists/oss-security/2026/08/07/4

Credits

🔍 Zhixi "Jace Sun", independent security researcher