PT-2026-61860 · Apache · Apache Fory
CVE-2026-60080
·
Published
2026-07-21
·
Updated
2026-07-27
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Apache Fory versions 0.13.0 through 1.3.0
Description
A Use After Free issue exists in the Rust deserialization logic of Apache Fory. This occurs when the software handles a crafted Fory payload, which can lead to undefined behavior, process crashes, or potential memory disclosure. Use After Free is a memory corruption flaw that happens when an application continues to use a pointer after it has been freed.
Recommendations
Update Apache Fory to version 1.4.0.
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Fory