Apache Fory
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_fory:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Fory (c56235de-e080-5ebb-b9eb-56a159ca8acb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71558 |
vulnerable | 2026-09-16 04:32:59.684855 |
Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
Heap type confusion vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
Published: 2026-08-07T08:54:56.897Z
Updated: 2026-08-07T17:48:23.240Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71559 |
vulnerable | 2026-09-16 04:32:59.572126 |
Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic.
This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
Published: 2026-08-07T08:56:09.167Z
Updated: 2026-08-07T17:51:17.894Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71560 |
vulnerable | 2026-09-16 04:32:59.459021 |
Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
Published: 2026-08-07T08:53:36.032Z
Updated: 2026-08-07T17:44:08.783Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64609 |
vulnerable | 2026-07-29 01:06:19.768764 |
Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2026-07-21T09:34:57.010Z
Updated: 2026-07-21T18:28:17.440Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64608 |
vulnerable | 2026-07-29 01:06:19.768575 |
Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.
This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2026-07-21T09:34:12.817Z
Updated: 2026-07-21T18:28:16.365Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64606 |
vulnerable | 2026-07-29 01:06:19.768219 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-60080 |
vulnerable | 2026-07-29 01:03:23.717435 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-50076 |
vulnerable | 2026-06-08 08:07:02.788745 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48207 |
vulnerable | 2026-06-08 08:05:12.266893 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-61622 |
vulnerable | 2026-06-08 07:37:27.676099 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-59328 |
vulnerable | 2026-06-08 07:35:21.670655 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.