Apache Fory vulnerabilities

• apache fory Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata CVE-2026-71559 7.5 HighAugust 7, 2026
• apache fory Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization CVE-2026-71558 9.8 CriticalAugust 7, 2026
• apache fory Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path CVE-2026-71560 9.1 CriticalAugust 7, 2026
• apache fory Apache Fory: Rust MetaString heap use-after-free CVE-2026-60080 7.3 HighJuly 21, 2026
• apache fory Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface CVE-2026-64606 9.8 CriticalJuly 21, 2026
• apache fory Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization CVE-2026-64609 9.1 CriticalJuly 21, 2026
• apache fory Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths CVE-2026-64608 9.8 CriticalJuly 21, 2026
• apache fory Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass CVE-2026-50076 Fix available 9.1 CriticalJune 4, 2026
• apache fory Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement CVE-2026-48207 Fix available 9.8 CriticalMay 21, 2026
• apache fory Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory CVE-2025-61622 Public exploitFix available EPSS 45.1% 9.8 CriticalOctober 1, 2025
• apache fory Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data CVE-2025-59328 Fix available 6.5 MediumSeptember 15, 2025