CVE-2026-60080
Received Received - Intake

Use After Free in Apache Fory

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Apache Software Foundation

Description
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-60080
EUVD
EUVD-2026-46174

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache fory From 0.13.0 (inc) to 1.3.0 (inc)
apache fory 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Use After Free vulnerability in Apache Fory's Rust deserialization logic. It occurs when a program tries to use memory that has already been freed, leading to undefined behavior, crashes, or memory disclosure. The issue affects versions 0.13.0 through 1.3.0.

Detection Guidance

This vulnerability is specific to Apache Fory's Rust deserialization logic. Detection requires checking the installed version of Apache Fory. If your system runs versions 0.13.0 through 1.3.0, it is vulnerable. Use commands like 'fory --version' or check package managers (e.g., 'apt list --installed | grep fory' or 'cargo list' for Rust-based installations) to verify the version.

Impact Analysis

A crafted Fory payload could cause your application to crash or expose sensitive memory contents. This may lead to denial of service or potential information leaks, depending on how Fory is used in your system.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves a use-after-free issue in Apache Fory's Rust deserialization logic, which could lead to undefined behavior, crashes, or memory disclosure. Such issues may indirectly affect compliance if they compromise data integrity or availability, but no explicit details are provided.

Mitigation Strategies

Upgrade Apache Fory to version 1.4.0 or later to fix the Use After Free vulnerability in the Rust deserialization logic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart