CVE-2026-60080

—

CVSS 3.1

7.3 high

EPSS

<1%p50

Published

Jul 21, 2026 (Jul 21, 2026)

Modified

Jul 27, 2026

Description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Vendors: apache
Products: fory
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.