CVE-2026-71559highCWE-502

CVE-2026-71559: falha de alta gravidade em Apache Fory

Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

Publicada em

Seguir esta CVE+ Monitorar Apache Fory

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0.  Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Apache Software Foundation · Apache Fory
CVEs relacionadas — Apache Fory

No mesmo produto, das mais perigosas para as menos.

CVE-2025-61622CRITICALApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyEPSS 49.0%CVE-2026-71558CRITICALApache Fory: Heap type confusion in C++ polymorphic smart-pointer deserializationEPSS 1.0%CVE-2026-64608CRITICALApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsEPSS 0.8%CVE-2026-64606CRITICALApache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interfaceEPSS 0.8%CVE-2026-64609CRITICALApache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserializationEPSS 0.8%CVE-2026-71560CRITICALApache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-pathEPSS 0.8%