PT-2026-61860 · Apache · Apache Fory

CVE-2026-60080

Published

2026-07-21

Updated

2026-07-21

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-60080

Apache Fory