CVE-2026-71559

HIGH

CVE: CVE-2026-71559 - Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service b...Sign in to save

CVSS

7.5

CVSS v3.1

EPSS

0.6%

Exploit Prediction Score

Published

August 7, 2026

Exploitability

EPSS probability 0.6%

Description

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Weaknesses

CWE-502

Affected Packages

No package data available.

Aliases

CVE-2026-71559

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://lists.apache.org/thread/f28bw002p32yt723rvv3dcwdkljys8r3
http://www.openwall.com/lists/oss-security/2026/08/07/4