CVE-2026-71560

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/xl2g544kctbgozccnj35qts43p452y5x	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/07/5	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de lectura fuera de límites en la deserialización de Apache Fory C++. Este problema afecta a las versiones de Apache Fory C++ desde la 0.14.0 anteriores a la 1.5.0 al deserializar estructuras que contienen campos de enteros etiquetados. Una carga útil de entrada manipulada puede desencadenar una lectura de pila fuera de límites en el deserializador de ruta rápida de enteros etiquetados, potencialmente causando revelación de información o denegación de servicio. Se recomienda a los usuarios actualizar a Apache Fory 1.5.0, que corrige este problema. Las aplicaciones que no utilizan Apache Fory C++ o no utilizan campos de enteros etiquetados no se ven afectadas.

Information

Published : 2026-08-07 10:16

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71560

Mitre link : CVE-2026-71560

CVE.ORG link : CVE-2026-71560

JSON object : View

Products Affected

apache

fory

CWE

CWE-502

Deserialization of Untrusted Data

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-71560", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71560", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:44:04.742307Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Fory", "versions": [{"status": "affected", "version": "0.14.0", "lessThan": "1.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-07T10:16:59.590", "references": [{"url": "https://lists.apache.org/thread/xl2g544kctbgozccnj35qts43p452y5x", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/07/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.\n\nThis issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.\n\n\nUsers are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected."}, {"lang": "es", "value": "Vulnerabilidad de lectura fuera de l\u00edmites en la deserializaci\u00f3n de Apache Fory C++.\n\nEste problema afecta a las versiones de Apache Fory C++ desde la 0.14.0 anteriores a la 1.5.0 al deserializar estructuras que contienen campos de enteros etiquetados. Una carga \u00fatil de entrada manipulada puede desencadenar una lectura de pila fuera de l\u00edmites en el deserializador de ruta r\u00e1pida de enteros etiquetados, potencialmente causando revelaci\u00f3n de informaci\u00f3n o denegaci\u00f3n de servicio.\n\nSe recomienda a los usuarios actualizar a Apache Fory 1.5.0, que corrige este problema. Las aplicaciones que no utilizan Apache Fory C++ o no utilizan campos de enteros etiquetados no se ven afectadas."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "772F10BC-3E7E-4292-A09B-5B981B9C088E", "versionEndExcluding": "1.5.0", "versionStartIncluding": "0.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}