CVE-2026-60080

7.3 Élevée

Publiée le 21/07/2026 à 14:18 · Modifiée le 27/07/2026 à 15:47 · Analysée par le NVD · Source : security@apache.org

Description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Fory
Apache fory

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.3 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-416

Références

https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/21/3 Third Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories