CVE-2026-60080

HighCVSS 7.3/10Last modified Oct 24, 2026

Description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
Apache Software FoundationApache Fory>= 0.13.0, <= 1.3.0

References

Timeline

Published
Jul 21, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-600817.5DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocatCVE-2026-600829.1DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but thCVE-2026-600834.9SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspaceCVE-2026-600848.7SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unCVE-2026-600857.5PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commandCVE-2026-600865.3PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified CVE-2026-600876.1PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent callsCVE-2026-600885.5PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the worCVE-2026-600895.5PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when construcCVE-2026-60098.7Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution oCVE-2026-600909.8PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collCVE-2026-600917.2PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The web
CVE-2026-60080: High severity, CVSS 7.3 | Vulnix