Fory (Apache) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 132 known versions, newest CVE from 2026-08-07. Vendor: Apache.
CVEs of Fory
- CVE-2026-71559 - CVSS 7.5 (high), 2026-08-07: Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted…
- CVE-2026-71558 - CVSS 9.8 (critical), 2026-08-07: Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input…
- CVE-2026-71560 - CVSS 9.1 (critical), 2026-08-07: Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing…
- CVE-2026-60080 - CVSS 7.3 (high), 2026-07-21: Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory…
- CVE-2026-64606 - CVSS 9.8 (critical), 2026-07-21: Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda…
- CVE-2026-64609 - CVSS 9.1 (critical), 2026-07-21: Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of…
- CVE-2026-64608 - CVSS 9.8 (critical), 2026-07-21: Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do…
- CVE-2026-50076 - CVSS 9.1 (critical), 2026-06-04: Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote…
- CVE-2026-48207 - CVSS 9.8 (critical), 2026-05-21: Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during…
- CVE-2025-61622 - CVSS 9.8 (critical), 2025-10-01: Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows…
- CVE-2025-59328 - CVSS 6.5 (medium), 2025-09-15: A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted…
