CVE-2026-71560
Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path
CVSS Score
0.0
EPSS Score
0.2%
EPSS Percentile
8th
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
| CWE | CWE-502 |
| Vendor | apache software foundation |
| Product | apache fory |
| Published | Aug 7, 2026 |
| Last Updated | Aug 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache fory
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache fory are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Fory
0.14.0 < 1.5.0
References
Credits
🔍 Zhixi "Jace Sun", independent security researcher