CVE-2026-60080 Overview
CVE-2026-60080 is a Use After Free vulnerability [CWE-416] in the Rust deserialization logic of Apache Fory. The flaw affects Apache Fory releases from 0.13.0 through 1.3.0. A crafted Fory payload can trigger undefined behavior, crash the host process, or disclose memory contents. Apache Fory is a cross-language serialization framework, so any Rust service that deserializes untrusted Fory data is exposed. The Apache Fory project has released version 1.4.0 to remediate the issue.
Critical Impact
A network-reachable attacker can send a malicious Fory payload to a Rust deserializer and cause process crash, undefined behavior, or memory disclosure without authentication or user interaction.
Affected Products
- Apache Fory Rust deserialization library, versions 0.13.0 through 1.3.0
- Applications embedding vulnerable Apache Fory versions to parse untrusted input
- Distributed systems and RPC services relying on Apache Fory serialization
Discovery Timeline
- 2026-07-21 - CVE-2026-60080 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-60080
Vulnerability Analysis
Apache Fory provides a Rust implementation of its cross-language serialization protocol. The deserializer reconstructs objects, references, and buffers from a wire-format payload. The vulnerable code path retains a reference to memory that has already been freed during deserialization. When the deserializer subsequently accesses that stale reference, the process operates on invalid memory.
The attack surface is network-facing. Any Rust service that decodes attacker-controlled Fory data can be reached without authentication or user interaction. Exploitation outcomes range from denial of service through process crash, to leakage of adjacent heap data, to undefined behavior that may compromise state integrity.
Root Cause
The root cause is a lifetime and ownership error in the Rust deserialization logic classified under [CWE-416] Use After Free. During object reconstruction, the deserializer releases a buffer or object while retaining a pointer or reference that is later dereferenced. Rust's safety guarantees do not extend to unsafe blocks or manual reference tracking used in high-performance serializers, and Apache Fory's deserializer contains such logic to support its zero-copy and reference-preserving features.
Attack Vector
The attacker delivers a crafted Fory payload to any endpoint that invokes the vulnerable Rust deserializer. The payload manipulates reference tables, object identifiers, or buffer descriptors so that the deserializer frees memory that a later step still uses. No prior privileges are required. Because Fory is commonly used in RPC and messaging pipelines, delivery vectors include HTTP request bodies, message queue payloads, and inter-service calls. See the Apache Security Mailing List Update and Openwall OSS Security Discussion for protocol-level context.
Detection Methods for CVE-2026-60080
Indicators of Compromise
- Unexpected crashes, segmentation faults, or panics in Rust services that use Apache Fory versions 0.13.0 through 1.3.0.
- Malformed or oversized Fory payloads observed in application logs or network captures.
- Anomalous memory content appearing in error messages, stack traces, or downstream responses that may indicate memory disclosure.
Detection Strategies
- Inventory dependencies to identify services linking any Apache Fory Rust crate version between 0.13.0 and 1.3.0.
- Enable Rust runtime hardening such as AddressSanitizer in staging to catch use-after-free events during fuzzing of Fory inputs.
- Fuzz the Fory deserializer with mutated reference tables and object graphs to reproduce the crash signature.
Monitoring Recommendations
- Alert on abnormal restart rates or panic log entries in services that expose Fory deserialization endpoints.
- Monitor network traffic to serialization endpoints for payloads exceeding expected size or structural bounds.
- Correlate crash telemetry with source IP addresses to detect targeted probing of the deserializer.
How to Mitigate CVE-2026-60080
Immediate Actions Required
- Upgrade Apache Fory to version 1.4.0 or later across all Rust services and dependent projects.
- Audit build manifests and lockfiles such as Cargo.toml and Cargo.lock to confirm no transitive dependency pins a vulnerable Fory release.
- Restrict network exposure of services that deserialize Fory payloads until patching is verified.
Patch Information
The Apache Fory project fixed the use-after-free in version 1.4.0. Users of any release from 0.13.0 through 1.3.0 must upgrade. Refer to the Apache Security Mailing List Update for the official advisory and version guidance.
Workarounds
- Terminate untrusted Fory traffic at an authenticated gateway to reduce exposure until the upgrade is deployed.
- Enforce strict payload size and schema validation before invoking the Rust deserializer.
- Isolate services that must accept external Fory data in sandboxed processes with automatic restart to contain crash impact.
# Configuration example
# Update Cargo.toml to require the patched Apache Fory release
# [dependencies]
# fory = ">=1.4.0"
cargo update -p fory --precise 1.4.0
cargo audit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
