CVE-2026-71560
CVE-2026-71560: 1 tracked advisory record across Apache. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityCritical9.1
Critical [CVE-2026-71560] Out-of-bounds Read vulnerability in Apache Fory C++ deserialization
CVE-2026-71560Source published Source updated
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
- Affected products in this advisory
- Apache Fory
- Source-reported affected versions
- 0.14.0 before 1.5.0
- Source-reported fixed versions
- 1.5.0
- Mitigation guidance
- Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.