Loading story…
Apache disclosed CVE-2026-71558, a heap type confusion flaw in Apache Fory's C++ deserialization logic that affects versions 0.14.0 through versions before 1.5.0. The vulnerability is triggered by a crafted input payload during polymorphic smart-pointer deserialization, allowing type compatibility checks to be bypassed so an incompatible object can be treated as the declared base type. Apache and downstream advisories warn that successful exploitation can cause undefined behavior and may lead to denial of service or arbitrary code execution.
The issue is tracked as CWE-502 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw with high impact across confidentiality, integrity, and availability. Apache said applications that do not use Fory C++ polymorphic smart-pointer deserialization are not affected, and recommended upgrading to Apache Fory 1.5.0, which fixes the bug. The vulnerability was reported by independent security researcher Zhixi "Jace" Sun, while CISA SSVC metadata listed exploitation as none observed, automatable as yes, and technical impact as total.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-07, the CVE record for CVE-2026-71558 was modified to add a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and an SSVC entry from CISA Coordinator. The SSVC entry recorded exploitation as none, automatable as yes, and technical impact as total.
On 2026-08-07, Chaokun Yang of Apache announced CVE-2026-71558, an important-severity heap type confusion flaw in Apache Fory C++ deserialization that could lead to denial of service or arbitrary code execution. The disclosure credited independent researcher Zhixi "Jace Sun" with reporting the issue.
Apache stated that upgrading to Apache Fory 1.5.0 remediates a heap type confusion vulnerability in C++ polymorphic smart-pointer deserialization affecting versions 0.14.0 before 1.5.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceopenwall.com
Open sourcelists.apache.org
Open sourcecve.org
Open sourcefory.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-64608**, a critical vulnerability in the **Apache Fory C++** implementation that can cause heap type confusion and out-of-bounds read/write during deserialization. The flaw occurs in compatible mode when field-skip paths do not properly validate declared field types against the actual data being processed, creating a memory-corruption condition that could have severe impact on affected deployments. The issue affects **Apache Fory C++ versions `0.14.0` through before `1.4.0`** and does **not** affect other Apache Fory language implementations. Apache has advised users to upgrade to **`1.4.0`** to remediate the bug. The vulnerability was reported by **Nguyen Van Hiep (`@hypnguyen1209`) of MBBank**, and CISA SSVC metadata indicates **no known exploitation** so far, while noting the issue may be **automatable** and carries **total technical impact**.
Jul 21, 2026
Apache disclosed **CVE-2026-64606**, a critical deserialization vulnerability in **Apache Fory** that lets attackers bypass class-registration checks during Java lambda deserialization through an auto-admitted `SerializedLambda` capturing interface. The flaw is tracked as **CWE-502** and carries a **CVSS 3.1** score reflecting network-exploitable, no-authentication impact with potential compromise of confidentiality, integrity, and availability. The issue affects `org.apache.fory:fory-core` versions from `0.11.0` before `1.4.0` and the earlier package line `org.apache.fury:fury-core` from `0.5.0` before `0.11.0`. Apache said the vulnerability was reported by **Charles Vosburgh** and fixed in **Apache Fory 1.4.0**; users are advised to upgrade immediately. A CISA SSVC entry listed exploitation as **none observed**, **automatable: yes**, and **technical impact: total**.
Jul 21, 2026
Apache disclosed **CVE-2026-50076**, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects `org.apache.fory:fory-core` versions before `1.1.0`. The flaw lies in the Java `ReplaceResolverSerializer` replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, `TypeChecker` enforcement, and `DisallowedList` protections during deserialization. If an application processes untrusted external data streams, a remote attacker can trigger classpath-present `readResolve` and `readExternal` hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version `1.1.0` by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (**r3dw0lfsec**) of Securin.
Jun 29, 2026