VulnSocial

CVE-2026-60080Disclosure(apache / fory)

LOWCVSS 7.3 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch apache fory systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fory

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
apache
Products
fory

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-21: 2Patch / Workaround · 2026-07-21: 1Technical Details · 2026-07-21: 207-21
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • MalwareObserver@MalwareObserver
    Disclosure

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-60080](https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy) Use After Free... https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy #CVE #ZeroDay #PatchManagement

    Post summary

    A new CVE-2026-60080 is disclosed as a use‑after‑free vulnerability with a reference to an Apache mailing list thread, but no exploit, patch, or active exploitation details are provided.

    0000033
    13 followersView on X
  • VulniPulse@vulnipulse
    Patch

    ⚠️ Apache Fory alert: CVE-2026-60080 (Unknown) Attackers could disrupt service or cause a denial of service. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/apache-cve-2026-60080 #Apache #ApacheFory #CyberSecurity #CVE

    Post summary

    The advisory announces CVE‑2026‑60080, a denial‑of‑service vulnerability, and recommends upgrading to the vendor’s fixed release, without mentioning any PoC, exploit code, or active exploitation.

    0000037
    6 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachefory---

Explore more

Back to dashboardapache CVEsfory vulnerabilities