Thrift (Apache) - vulnerabilities (CVEs)

32 CVEs, 0 in the last 30 days, 60 known versions, newest CVE from 2026-07-27. Vendor: Apache.

CVEs of Thrift

• CVE-2026-66053 - CVSS 5.9 (medium), 2026-07-27: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users…
• CVE-2026-58662 - CVSS 9.1 (critical), 2026-07-27: Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before…
• CVE-2026-58389 - CVSS 8.7 (high), 2026-07-27: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are…
• CVE-2026-58023 - CVSS 9.1 (critical), 2026-07-27: Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to…
• CVE-2026-55971 - CVSS 9.8 (critical), 2026-07-27: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to…
• CVE-2026-55970 - CVSS 6.9 (medium), 2026-07-27: Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version…
• CVE-2026-55969 - CVSS 8.7 (high), 2026-07-27: Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before…
• CVE-2026-55968 - CVSS 8.7 (high), 2026-07-27: Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects…
• CVE-2026-49158 - CVSS 7.5 (high), 2026-07-27: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before…
• CVE-2026-48586 - CVSS 8.7 (high), 2026-07-27: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects…
• CVE-2026-48145 - CVSS 8.2 (high), 2026-07-27: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are…
• CVE-2026-48144 - CVSS 9.1 (critical), 2026-07-27: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users…
• CVE-2026-45112 - CVSS 7.5 (high), 2026-07-27: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before…
• CVE-2026-43871 - CVSS 8.7 (high), 2026-07-27: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift:…
• CVE-2026-41608 - CVSS 7.5 (high), 2026-07-27: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before…
• CVE-2026-43868 - CVSS 7.5 (high), 2026-05-05: Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade…
• CVE-2026-43870 - CVSS 7.3 (high), 2026-05-05: Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP…
• CVE-2026-43869 - CVSS 7.3 (high), 2026-05-05: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended…
• CVE-2026-41604 - CVSS 8.2 (high), 2026-04-28: Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which…
• CVE-2026-41607 - CVSS 9.1 (critical), 2026-04-28: Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which…
• CVE-2026-41602 - CVSS 7.5 (high), 2026-04-28: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.…
• CVE-2026-41606 - CVSS 7.5 (high), 2026-04-28: Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0,…
• CVE-2026-41605 - CVSS 7.7 (high), 2026-04-28: Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version…
• CVE-2026-41636 - CVSS 8.7 (high), 2026-04-28: Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to…
• CVE-2025-48431 - CVSS 7.5 (high), 2026-04-28: Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are…
• CVE-2020-13949 - CVSS 7.5 (high), 2021-02-12: In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to…
• CVE-2019-0210 - CVSS 7.5 (high), 2019-10-29: In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
• CVE-2019-0205 - CVSS 7.5 (high), 2019-10-29: In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the…
• CVE-2018-1320 - CVSS 7.5 (high), 2019-01-07: Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…
• CVE-2018-11798 - CVSS 6.5 (medium), 2019-01-07: The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user…
• CVE-2016-5397 - CVSS 8.8 (high), 2018-02-12: The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected…
• CVE-2015-3254 - CVSS 6.5 (medium), 2017-06-16: The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors…