CVE-2026-60080

published 2026-07-21

CVE-2026-60080: Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload…

Priority P3 47 high 7.3 CVSS 3.1

AV N AC L PR N UI N S U C L I L A L

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	fory	>= 0.13.0 < 1.4.0	1.4.0
apache_software_foundation	apache_fory	0.13.0 – 1.3.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416