Advisories · Technology
Apache Software Foundation Apache Fory.
Every CVE that names Apache Software Foundation Apache Fory among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata
- Apache Software Foundation Apache Fory
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
- Apache Software Foundation Apache Fory
- Insecure deserialization
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path
- Apache Software Foundation Apache Fory
- Insecure deserialization
- CVSS 7.3 High
Apache Fory: Rust MetaString heap use-after-free
- Apache Software Foundation Apache Fory
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
- Apache Software Foundation Apache Fory
- Insecure deserialization
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
- Apache Software Foundation Apache Fory
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
- Apache Software Foundation Apache Fory
- Insecure deserialization
- Memory corruption