CVE-2026-60080

CVE-2026-60080: Apache Fory: Rust MetaString heap use-after-free

Vendor Apache Software Foundation

Product Apache Fory

Weakness CWE-416

Published July 21, 2026

Last update July 21, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Key dates

02Disclosure timeline

July 21, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-60080 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/416.html AskarLabs — CWE-416 write-up Use After Free