CVE-2026-71560: Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from…
CVE-2026-71560 · Severity: critical · CVSS 9.1 · Published 2026-08-07
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
No. Junglewise Threat Intelligence has no report of CVE-2026-71560 being exploited in the wild.
How severe is CVE-2026-71560?
Critical severity, with a CVSS score of 9.1, published 7 August 2026.
Which products and versions are affected?
Apache Fory. The advisory does not name versions.
Is there a fix for CVE-2026-71560?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-71560?
Check whether you run Apache Fory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.