Deserialization Vulnerability in Apache Fory Affects Go Implementation
CVE-2026-71559

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Fory
Vendor
CVE Published:
7 August 2026

What is CVE-2026-71559?

A deserialization vulnerability in the Go implementation of Apache Fory could enable attackers to execute a denial of service attack by submitting specially crafted data with malformed type metadata. This flaw affects multiple versions from 0.16.0 and is not present in later versions, making it crucial for users to upgrade to version 1.5.0 to remediate this issue. Prompt action is recommended to maintain the integrity and availability of services.

Affected Version(s)

Apache Fory 0.16.0 < 1.5.0

References

https://lists.apache.org/thread/f28bw002p32yt723rvv3dcwdk...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhixi "Jace Sun", independent security researcher
.