Description
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2026-07-21
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free in the Rust deserialization logic of Apache Fory. A malicious actor can craft a payload that triggers undefined behavior, potentially causing a process crash or leaking memory contents. This flaw belongs to CWE‑416 and can lead to denial of service or accidental disclosure of sensitive data.

Affected Systems

Affected versions are Apache Fory from 0.13.0 up to and including 1.3.0. Users running any of these releases are susceptible to the issue. The vendor recommends upgrading to version 1.4.0 or later, where the bug has been fixed.

Risk and Exploitability

The CVSS score of 7.3 points to a medium‑to‑high severity vulnerability. The EPSS score is below 1%, indicating a very low probability of exploitation in current public data, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, attack developers can remotely deliver the crafted deserialization payload if the application accepts untrusted data, so the risk remains tangible for exposed services.

Generated by OpenCVE AI on August 4, 2026 at 05:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch that defines 1.4.0 or newer versions of Apache Fory.
  • If an upgrade is not immediately possible, block or quarantine any services that deserialize Fory payloads from untrusted sources.
  • Implement input validation or sandboxing to limit the impact of malformed payloads until a permanent fix is deployed.

Generated by OpenCVE AI on August 4, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache fory
Vendors & Products Apache
Apache fory

Tue, 21 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Description Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Title Apache Fory: Rust MetaString heap use-after-free
Weaknesses CWE-416
References

Subscriptions

Apache Fory
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-22T16:12:10.640Z

Reserved: 2026-07-08T11:03:34.462Z

Link: CVE-2026-60080

cve-icon Vulnrichment

Updated: 2026-07-21T18:28:14.230Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T12:18:58.697

Modified: 2026-07-27T13:47:47.453

Link: CVE-2026-60080

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T06:00:05Z

Weaknesses