An attacker can trigger an uncaught panic during the Go meta‑string decoding process by supplying crafted data with malformed type metadata. The panic causes the application to terminate, resulting in a denial of service. The vulnerability is a classic deserialization of untrusted data flaw, classified as CWE‑502, and can be exploited remotely by providing malicious metadata to the affected service.

The flaw is present in the Go implementation of Apache Fory, affecting all releases from 0.16.0 up to, but not including, 1.5.0. Users of other language implementations are not impacted. Any system that hosts the Go version of Fory and accepts external metadata is vulnerable.

The lack of a defensive check leads to out‑of‑band crashes that can be repeated to bring the service down. With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is below 1%, indicating a low likelihood of exploitation, yet the attack can still be carried out remotely if the service accepts external metadata. No publicly available exploit is known, but the ease of reproduction makes the risk tangible for exposed services.