CVE-2026-71559

This CVE affects only the Go implementation of Apache Fory, not the Java, C++, or other language ports. The root cause is malformed type metadata in deserialized data triggering a panic in the Go runtime rather than being caught as a returned error — resulting in process termination and denial of service. The Go panic/recover mechanism was designed for programmer errors on trusted inputs, not hostile input arriving over the wire. When untrusted data violates assumptions about type metadata validity that the code assumed could never happen, the panic escapes whatever error handling exists upstream, terminating the entire process and affecting all concurrent connections. Upgrade to version 1.5.0 to remediate. Beyond applying the patch, audit your own Go code that handles untrusted serialization input (particularly protobuf, gRPC, or any protocol with type-metadata fields). Look for code paths where type metadata is used without validation checks, where the comment 'this cannot happen' or 'impossible input' appears, or where the code predates the service's exposure to untrusted networks. These are the fossil assumptions that harbor this class of vulnerability. The blast radius here is broader than a caught exception in Java or Python — a panic at the process level takes down all connections, not just the offending request. This pattern has appeared in prior Go CVEs (CVE-2022-41717, CVE-2021-44717), suggesting the Go ecosystem accumulates these dormant assumptions in parsing layers. Consider this a systemic risk signal: every Go serialization handler processing external input is a candidate for review, regardless of how stable the code appears.

Reviewed through automated stages and approved by a human before publication.