CVE-2026-71560: Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Fory C++to a version that resolves this vulnerability.Fixed in 1.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71560?
CVE-2026-71560 has a risk rating of 26, indicating a serious vulnerability.
How do I fix CVE-2026-71560?
To fix CVE-2026-71560, upgrade Apache Fory to version 1.5.0 or later.
What versions of Apache Fory are affected by CVE-2026-71560?
CVE-2026-71560 affects Apache Fory C++ versions from 0.14.0 up to but not including 1.5.0.
What kind of vulnerability is CVE-2026-71560?
CVE-2026-71560 is an out-of-bounds read vulnerability occurring during C++ struct deserialization.
What impact could CVE-2026-71560 have on my application?
CVE-2026-71560 could lead to potential memory disclosure due to out-of-bounds heap reads.