CVE-2026-60080: Apache Fory

High severity, CVSS 7.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Affected products

• Apache Fory: from 0.13.0, before 1.4.0 (fixed in 1.4.0)

Published 2026-07-21. Last modified 2026-07-27.