CRITICAL 9.1 NVD
CVE-2026-71560
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing st
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
Affected Products
- apache/fory
References
- https://lists.apache.org/thread/xl2g544kctbgozccnj35qts43p452y5x
- http://www.openwall.com/lists/oss-security/2026/08/07/5
- https://www.openwall.com/lists/oss-security/2026/08/07/5
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-08-07 via NVD. Affected: apache/fory.
Risk Timeline
CVE Disclosed2026-08-07 · 2 days ago
Remediation Resources
Official Advisory
www.openwall.com/lists/oss-security/2026/08/07/5Official Advisory
www.openwall.com/lists/oss-security/2026/08/07/5Analysis & PoC
lists.apache.org/thread/xl2g544kctbgozccnj35qts43p452y5xRelated Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2026-61484 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability | CRITICAL | 9.8 |
| CVE-2026-61486 | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apa | CRITICAL | 9.8 |
| CVE-2026-66909 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessag | CRITICAL | 9.8 |
| CVE-2026-68079 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code | CRITICAL | 9.8 |
| CVE-2026-71558 | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issu | CRITICAL | 9.8 |
| CVE-2026-60053 | Insufficient Session Expiration vulnerability in Apache Answer. This issue affe | CRITICAL | 9.1 |
vulnfeed aggregates 8893 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.