Apache Software Foundation Apache Fory

• CVE-2026-71559 High 7.5 Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata 0.8%
• CVE-2026-71558 Critical 9.8 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization 1.0%
• CVE-2026-71560 Critical 9.1 Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path 0.8%
• CVE-2026-60080 High 7.3 Apache Fory: Rust MetaString heap use-after-free 0.7%
• CVE-2026-64606 Critical 9.8 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface 0.8%
• CVE-2026-64609 Critical 9.1 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization 0.8%
• CVE-2026-64608 Critical 9.8 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths 0.8%
• CVE-2026-50076 Critical 9.1 Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass 0.5%
• CVE-2026-48207 Critical 9.8 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement 0.6%
• CVE-2025-61622 Critical 9.8 Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory 45.1%
• CVE-2025-59328 Medium 6.5 Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data 0.7%