CVE-2026-71559

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic.

This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Aug 7, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-71569.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi o CVE-2026-715609.1Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 w CVE-2026-715626.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to CVE-2026-715634.3Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP CVE-2026-715647.8Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t CVE-2026-715655.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-715669.3FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC CVE-2026-715677.7In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them eit CVE-2026-715685.3In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race CVE-2026-71577.3A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknow CVE-2026-715705.1Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped t CVE-2026-715718.6Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators w