Vulnerabilities

TI-2026-50131 CVE-2026-71559 · GHSA-63m9-m4r7-4qjg

Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

MEDIUM 40

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an unca…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00799 Published 2026-08-07 Fixed in 1.5.0 CWE-502

TI-2026-50130 CVE-2026-71558 · GHSA-rwv5-p9fv-c8fp

Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

MEDIUM 51

Heap type confusion vulnerability in Apache Fory C++ deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0099 Published 2026-08-07 Fixed in 1.5.0 CWE-502

TI-2026-50132 CVE-2026-71560 · GHSA-r6vj-r3jc-f9gp

Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

MEDIUM 49

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00767 Published 2026-08-07 Fixed in 1.5.0 CWE-502

Vulnerabilities

Filters

Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path