CVE-2026-71560 Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path
A crafted payload in Apache Fory C++ can trigger an out-of-bounds heap read, leading to information disclosure or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71560?
CVE-2026-71560 is a critical unsafe deserialization vulnerability in Apache Fory, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
Which versions are affected by CVE-2026-71560?
It affects 1 product.
Products include Apache Fory.
How do I fix CVE-2026-71560?
No fix has been published for CVE-2026-71560 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-71560 being exploited?
There is no known exploitation of CVE-2026-71560 in the wild and no public exploit code.
Other vulnerabilities in Apache Fory
- CVE-2026-71558 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
- CVE-2026-64606 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
- CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
- CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
- CVE-2025-61622 Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
Sources
Also known as GHSA-r6vj-r3jc-f9gp.