# CVE-2026-60080: Apache Fory Use After Free in Rust deserialization logic

Source: https://junglewise.ai/threats/cve-2026-60080-apache-fory-use-after-free-in-rust-deserialization-logic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-60080 · Severity: info · Published 2026-07-21

Apache Fory, a data processing component, contains a memory management flaw in its data handling logic. An attacker could send a specially crafted data payload to trigger a system crash or potentially gain access to sensitive information stored in the system's memory. This could lead to service interruptions or unauthorized data exposure.

Technologies: [Apache Software Foundation Fury](https://junglewise.ai/threats/technologies/fury). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-60080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60080 being exploited in the wild.

**How severe is CVE-2026-60080?** Informational severity, published 21 July 2026.

**Which products and versions are affected?** Apache Software Foundation Fury 0.13.0 through 1.3.0.

**Is there a fix for CVE-2026-60080?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-60080 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-60080?** Check whether you run Apache Software Foundation Fury at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Use After Free (CWE-416) vulnerability exists in the Rust deserialization logic of Apache Fory. The flaw is triggered when the application processes a maliciously crafted Fory payload, leading to memory corruption. An attacker can exploit this to cause undefined behavior, a process crash (Denial of Service), or potential memory disclosure. The vulnerability affects versions 0.13.0 through 1.3.0 and is resolved in version 1.4.0.

## Affected products

- Apache Software Foundation Fory 0.13.0 through 1.3.0

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: advisory

## References

- [https://crates.io/](https://crates.io/)
- [https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy](https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy)

## Related threats

- [Apache Fury deserialization bypass in Java lambda deserialization](https://junglewise.ai/threats/cve-2026-64606-apache-fury-deserialization-bypass-in-java-lambda-deserialization)
- [Apache Fory out-of-bounds read in zero-copy deserialization](https://junglewise.ai/threats/cve-2026-64609-apache-fory-out-of-bounds-read-in-zero-copy-deserialization)