High · 7.3 CVE-2026-60080 EUVD-2026-46174GHSA-8g3p-5q43-955w

Apache Fory: Rust MetaString heap use-after-free

Published Jul 21, 2026 · Updated Jul 22, 2026 · Assigned by apache

Description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Fory	0.13.0 – ≤ 1.3.0	—