CVE-2026-71560 Overview
CVE-2026-71560 is an out-of-bounds read vulnerability in the Apache Fory C++ deserializer. The flaw affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when processing structs that contain tagged integer fields. A crafted input payload triggers an out-of-bounds heap read in the tagged integer fast-path deserializer. Successful exploitation can lead to information disclosure from adjacent heap memory or process crash conditions that result in denial of service. Apache published fixes in Fory 1.5.0. Applications that do not link the C++ runtime or do not use tagged integer fields are not affected.
Critical Impact
Network-reachable services deserializing untrusted Apache Fory payloads can leak heap memory or crash, with no authentication or user interaction required.
Affected Products
- Apache Fory C++ 0.14.0 through versions prior to 1.5.0
- Applications embedding Apache Fory C++ deserialization with tagged integer struct fields
- Downstream services and language bindings that invoke the affected C++ fast-path deserializer
Discovery Timeline
- 2026-08-07 - CVE-2026-71560 published to NVD
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-71560
Vulnerability Analysis
Apache Fory is a multi-language serialization framework that emphasizes high throughput through fast-path decoders. The vulnerability resides in the C++ deserializer path that handles tagged integer fields inside structs. The fast-path routine reads encoded integer data without adequately validating the remaining buffer length against the tag-declared field size. When a crafted payload advertises a tagged integer field extending beyond the allocated input buffer, the deserializer reads past the end of the heap allocation.
The out-of-bounds read maps to [CWE-125], with an underlying insecure deserialization root cause tracked as [CWE-502]. Attackers can either exfiltrate adjacent heap contents through subsequent field echoes or corrupt parser state to force process termination. Because Apache Fory is commonly used inside data pipelines, RPC frameworks, and cache serialization layers, exploit payloads can be delivered over any network channel that forwards Fory-encoded messages to a vulnerable consumer.
Root Cause
The tagged integer fast-path deserializer trusts length metadata carried inside the serialized struct without cross-checking it against the remaining input buffer. This missing bounds check allows the deserializer to advance its read cursor past the end of the input allocation.
Attack Vector
An unauthenticated remote attacker submits a serialized Fory payload containing a tagged integer field with manipulated length or offset metadata. When the target service deserializes the message using the affected C++ path, the parser dereferences memory beyond the buffer bounds. Depending on heap layout, the operation either returns residual data to the caller or triggers a segmentation fault.
No verified exploit code is public. See the Apache Security Thread and the Openwall OSS Security Update for advisory-level technical details.
Detection Methods for CVE-2026-71560
Indicators of Compromise
- Repeated segmentation faults or abnormal termination of processes linking libfory or Apache Fory C++ bindings
- Unexpected memory contents echoed in RPC responses from services deserializing Fory payloads
- Fory-encoded network messages with abnormally large tagged integer field length metadata relative to overall payload size
Detection Strategies
- Inventory build manifests, container images, and package lockfiles for Apache Fory C++ versions between 0.14.0 and 1.5.0
- Instrument deserialization entry points with AddressSanitizer or heap canaries in pre-production to surface out-of-bounds reads on fuzzed Fory inputs
- Deploy protocol-aware parsers or WAF rules at ingress to flag Fory payloads with inconsistent field length metadata
Monitoring Recommendations
- Alert on repeated crash-loop signatures in workloads that ingest external serialized data
- Monitor egress payload sizes and content entropy for services deserializing untrusted Fory streams to detect memory disclosure patterns
- Correlate application crash telemetry with upstream network sources to identify attacker probing
How to Mitigate CVE-2026-71560
Immediate Actions Required
- Upgrade all Apache Fory C++ dependencies to version 1.5.0 or later across build pipelines, containers, and runtime hosts
- Restrict network exposure of services that deserialize Fory payloads to trusted peers until the upgrade is complete
- Audit downstream language bindings and native extensions that transitively invoke the C++ fast-path deserializer
Patch Information
Apache Fory 1.5.0 remediates the out-of-bounds read by validating buffer bounds before dereferencing tagged integer field data. Consult the Apache Security Thread for the official fix reference and upgrade notes.
Workarounds
- Remove or refactor tagged integer fields from struct schemas until the upgrade is applied
- Route Fory payloads through a trusted proxy that authenticates producers and rejects untrusted senders
- Apply strict input size limits and schema validation at the network boundary to reject malformed payloads before deserialization
# Configuration example
# Verify installed Apache Fory C++ version and upgrade
pkg-config --modversion fory
# Pin the fixed version in your build system (example: vcpkg)
vcpkg install fory:x64-linux --version 1.5.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
