Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Apache Fory — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in Apache Fory, with AI-generated Chinese analysis, references, and POCs.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-71559 Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata CWE-502 - - 2026-08-07
CVE-2026-71558 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization CWE-502 - - 2026-08-07
CVE-2026-71560 Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path CWE-502 - - 2026-08-07
CVE-2026-60080 Apache Fory: Rust MetaString heap use-after-free CWE-416 - - 2026-07-21
CVE-2026-64606 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface CWE-502 - - 2026-07-21
CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization CWE-125 - - 2026-07-21
CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths CWE-843 - - 2026-07-21
CVE-2026-50076 Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass CWE-502 - - 2026-06-04
CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement CWE-502 - - 2026-05-21
CVE-2025-61622 Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory CWE-502 9.8AI Critical AI 2025-10-01
CVE-2025-59328 Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data CWE-502 7.5AI High AI 2025-09-15

All 11 known CVE vulnerabilities affecting Apache Fory with full Chinese analysis, references, and POCs where available.