CRITICAL🇵🇱 Wersja polska

CVE-2026-71560

CVSS 9.1v3.1pub. 2026-08-07upd. 2026-08-08

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Apache Fory

    APP
    Apache
    0.14.0 – 1.5.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoSMemoryDeserialization
CWE
References

Related vulnerabilities

CVE-2026-71558CRITICAL9.8PL ✓same product

Apache Fory C++: type confusion w deserializacji umożliwia RCE

CVE-2026-64609CRITICAL9.1PL ✓same product

Apache Fory: out-of-bounds read przy deserializacji zero-copy

CVE-2026-64606CRITICAL9.8PL ✓same product

Apache Fury — pominięcie kontroli klas przy deserializacji wyrażeń lambda

CVE-2026-64608CRITICAL9.8PL ✓same product

Apache Fory C++: type confusion i out-of-bounds w deserializacji

CVE-2026-50076CRITICAL9.1PL ✓same product

Apache Fory – niebezpieczna deserializacja danych w Java SDK (RCE)