Executive brief
Apache Fory is a data serialization framework used to communicate between different software components. A vulnerability in its C++ implementation allows an attacker to send specially crafted data that causes the system to crash or potentially execute unauthorized actions. This could lead to service outages or the exposure of sensitive information processed by the application.
Technical details
The Apache Fory C++ implementation contains a vulnerability involving heap type confusion (CWE-843) and out-of-bounds read/write (CWE-787) during deserialization. When operating in 'compatible mode', the field-skip logic fails to properly validate declared field types against the actual incoming data stream. An attacker can provide input with an inconsistent schema to trigger type confusion, leading to memory corruption. This issue is specific to the C++ implementation and affects versions 0.14.0 through 1.3.x. Users should upgrade to version 1.4.0 to resolve the flaw.
Affected products
- Apache Software Foundation Fory C++ 0.14.0 to 1.3.x (before 1.4.0)
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 1.4.0