CVE-2026-60080

CVE-2026-60080CVE-2026-60080

Description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Scoring

Last modified2026-07-21
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.