Priority MEDIUM 40
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an unca…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00799 · Published 2026-08-07 · Fixed in 1.5.0 CWE-502
Priority MEDIUM 51
Heap type confusion vulnerability in Apache Fory C++ deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-08-07 · Fixed in 1.5.0 CWE-502
Priority MEDIUM 49
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00767 · Published 2026-08-07 · Fixed in 1.5.0 CWE-502
Priority LOW 39
Use After Free vulnerability in the Rust deserialization logic of Apache Fory.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00684 · Published 2026-07-21 · No fix listed CWE-416
Priority MEDIUM 50
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00782 · Published 2026-07-21 · Fixed in 1.4.0, 0.11.0 CWE-502
Priority MEDIUM 47
Out-of-bounds read via sun.misc.Unsafe in Apache Fory.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00777 · Published 2026-07-21 · Fixed in 1.4.0, 0.11.0 CWE-125
Priority MEDIUM 50
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00806 · Published 2026-07-21 · Fixed in 1.4.0 CWE-502
Priority MEDIUM 48
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedLi…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0052 · Published 2026-06-04 · Fixed in 1.1.0 CWE-502
Priority MEDIUM 50
Deserialization of untrusted data in Apache Fory PyFory.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00574 · Published 2026-05-21 · Fixed in 1.0.0 CWE-502
Priority HIGH 73
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.47777 · Published 2025-10-01 · Fixed in 0.12.3 CWE-502
Priority LOW 30
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00685 · Published 2025-09-15 · Fixed in 0.12.2 CWE-502
THREATIST.IORead the docs