Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-08 | 1 | Disclosure1 |
| 2026-08-10 | 1 | General1 |
⚠️ Vulnerabilidades en productos Apache ❗ CVE-2026-71560 ❗ CVE-2026-71559 ❗ CVE-2026-71558 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-apache-6/ https://t.co/JX6ijCbQ3M
Post summary
The tweet simply announces three Apache CVEs and links to additional information without providing PoC, exploit details, patch info, or technical specifics.
⚠️ Apache Fory C++ memory flaw could lead to RCE CVE-2026-71558 affects Apache Fory C++ before 1.5.0. Crafted serialized input can trigger heap type confusion during polymorphic smart-pointer deserialization, potentially causing crashes or even arbitrary code execution. 🔎 Source: Apache / Tenable. #Apache #MemorySafety #RCE #CVE #CyberSecurity
Post summary
Apache Fory C++ before 1.5.0 is vulnerable to heap type confusion leading to potential RCE; no PoC, exploit, patch, or active exploitation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | fory | - | - | - |