What’s Vulnerable › Products

Apache Software Foundation Apache Fory vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your Apache Software Foundation Apache Fory version is affected

Latest Apache Software Foundation Apache Fory vulnerabilities

• CVE-2026-71560 — Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path (CVSS 9.1)
• CVE-2026-71559 — Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata (CVSS 7.5)
• CVE-2026-71558 — Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization (CVSS 9.8)
• CVE-2026-60080 — Apache Fory: Rust MetaString heap use-after-free (CVSS 7.3)
• CVE-2026-64606 — Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface (CVSS 9.8)
• CVE-2026-64609 — Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization (CVSS 9.1)
• CVE-2026-64608 — Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths (CVSS 9.8)
• CVE-2026-50076 — Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass (CVSS 9.1)
• CVE-2026-48207 — Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement (CVSS 9.8)
• CVE-2025-61622 — Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory (CVSS 9.8)
• CVE-2025-59328 — Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data (CVSS 6.5)