CVE-2026-71560
CVE-2026-71560
9.1
CriticalPublished:
Last updated:
Source:security@apache.org
Analyzed
CVSS Vector
v3.1- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Description
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
References
security@apache.org
https://lists.apache.org/thread/xl2g544kctbgozccnj35qts43p452y5xaf854a3a-2127-422b-91ae-364da2661108
http://www.openwall.com/lists/oss-security/2026/08/07/5