CVE-2026-71559 Overview
CVE-2026-71559 is a deserialization of untrusted data vulnerability in the Go implementation of Apache Fory. An attacker can supply crafted serialized data containing malformed type metadata to trigger an uncaught panic in the deserializer. The panic halts the affected process and produces a denial of service condition.
The issue affects Apache Fory versions from 0.16.0 before 1.5.0. Users of other language implementations (Java, Python, C++, JavaScript, Rust) are not affected. The Apache Fory project recommends upgrading to version 1.5.0, which contains the fix. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.
Critical Impact
Remote attackers can crash Go-based services that deserialize Apache Fory payloads by sending malformed type metadata, producing a persistent denial of service against network-exposed endpoints.
Affected Products
- Apache Fory (Go implementation) 0.16.0 through versions prior to 1.5.0
- Go applications and services that consume Apache Fory serialized payloads from untrusted sources
- Downstream projects embedding the vulnerable Fory Go module
Discovery Timeline
- 2026-08-07 - CVE-2026-71559 published to NVD
- 2026-08-07 - Vendor advisory published to the Apache security mailing list
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-71559
Vulnerability Analysis
Apache Fory is a multi-language serialization framework built for high-performance data exchange. The Go implementation parses type metadata from incoming byte streams to reconstruct arbitrary Go objects. When the deserializer encounters malformed type metadata, it fails to validate or bounds-check the structure before use.
The unvalidated access triggers a runtime panic that the library does not recover. Because the panic propagates up the call stack, callers that invoke Fory deserialization without their own recover() handler will terminate the goroutine or, in server contexts, crash the entire process. The result is a network-reachable denial of service against any service that accepts Fory payloads.
Root Cause
The root cause is missing input validation on type metadata fields during deserialization. The Go implementation trusts length prefixes, type identifiers, or reference indexes embedded in the serialized stream and passes them into operations that can panic, such as slice indexing or map lookups on invalid types. Version 1.5.0 adds validation and controlled error handling to reject malformed metadata rather than panic.
Attack Vector
An unauthenticated attacker sends a crafted Fory-encoded payload to any network endpoint that deserializes untrusted input using the affected Go library. No user interaction, credentials, or prior access are required. Exploitation does not disclose data or modify state, but it terminates the receiving process, degrading availability of API gateways, message consumers, and RPC servers that rely on Fory for wire-format decoding.
No verified public proof-of-concept has been released. See the Apache Security Mailing List Thread and the OpenWall OSS Security Update for vendor technical details.
Detection Methods for CVE-2026-71559
Indicators of Compromise
- Repeated runtime error or panic: stack traces in Go application logs referencing fory package frames or type metadata parsing functions
- Unexpected process restarts or crash loops in services that accept Fory-encoded payloads over HTTP, gRPC, or message queues
- Inbound requests carrying Fory magic bytes from unusual source addresses or with abnormally short or truncated payload lengths
Detection Strategies
- Inventory Go binaries and container images for the github.com/apache/fory (or equivalent) module and flag versions 0.16.0 through those prior to 1.5.0
- Correlate application panic events with inbound network traffic to Fory-consuming endpoints to identify targeted crash attempts
- Alert on rapid succession of process exits or supervisor restarts on hosts running Fory-dependent services
Monitoring Recommendations
- Aggregate Go runtime panic logs into a centralized logging pipeline with alerts on fory-scoped stack frames
- Monitor request rates and payload size distributions at ingress points that terminate Fory traffic to detect anomalous small or malformed messages
- Track service availability metrics (restart count, uptime, error budget) for microservices that deserialize third-party data
How to Mitigate CVE-2026-71559
Immediate Actions Required
- Upgrade the Apache Fory Go module to version 1.5.0 or later across all affected services and rebuild dependent binaries
- Audit code paths that call Fory deserialization on network-attacker-controlled input and restrict exposure where possible
- Add recover() handlers around deserialization boundaries as a defense-in-depth measure to prevent full-process termination
Patch Information
Apache Fory 1.5.0 fixes the vulnerability by validating type metadata during deserialization. Upgrade instructions and release notes are referenced in the Apache Security Mailing List Thread. Update the module dependency with go get github.com/apache/fory/go/fory@v1.5.0 and rebuild affected binaries. Other language implementations of Fory are not affected and require no action.
Workarounds
- Restrict Fory deserialization endpoints to trusted, authenticated peers using mutual TLS or network segmentation until patching completes
- Place a validating proxy or size-limiting gateway in front of Fory consumers to drop malformed or oversized payloads
- Wrap Fory decode calls in a defer/recover() block to convert panics into handled errors, limiting blast radius to a single request
# Upgrade the Apache Fory Go module to the patched version
go get github.com/apache/fory/go/fory@v1.5.0
go mod tidy
go build ./...
# Verify the resolved version
go list -m github.com/apache/fory/go/fory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
