CVE-2026-71559: Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic.
This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/foryto a version that resolves this vulnerability.Fixed in 1.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71559?
CVE-2026-71559 has a risk score of 35, indicating a significant threat.
How do I fix CVE-2026-71559?
To fix CVE-2026-71559, upgrade Apache Fory to version 1.5.0 or later.
What is the impact of CVE-2026-71559?
CVE-2026-71559 allows attackers to cause a denial of service by triggering an uncaught panic in the application.
Which versions of Apache Fory are affected by CVE-2026-71559?
CVE-2026-71559 affects Apache Fory versions from 0.16.0 up to, but not including, 1.5.0.
What type of vulnerability is CVE-2026-71559 classified as?
CVE-2026-71559 is classified as a Deserialization of Untrusted Data vulnerability.