Apache Thrift (Apache Software Foundation) - vulnerabilities (CVEs)

89 CVEs, 61 in the last 30 days, 2 known versions, newest CVE from 2026-10-02. Vendor: Apache Software Foundation.

CVEs of Apache Thrift

• CVE-2026-66054 - CVSS 6.9 (medium), 2026-10-02: Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++…
• CVE-2026-61374 - CVSS 7.1 (high), 2026-10-02: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
• CVE-2026-63772 - CVSS 8.7 (high), 2026-10-02: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
• CVE-2026-66055 - CVSS 8.2 (high), 2026-10-02: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects…
• CVE-2026-66081 - CVSS 8.7 (high), 2026-10-02: Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to…
• CVE-2026-66331 - CVSS 6.9 (medium), 2026-10-02: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift:…
• CVE-2026-66837 - CVSS 8.7 (high), 2026-10-02: Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0.…
• CVE-2026-66858 - CVSS 8.7 (high), 2026-10-02: The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough…
• CVE-2026-66859 - CVSS 8.7 (high), 2026-10-02: NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users…
• CVE-2026-83632 - CVSS 9.2 (critical), 2026-10-02: Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue…
• CVE-2026-83663 - CVSS 8.7 (high), 2026-10-02: Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no…
• CVE-2026-83745 - CVSS 8.7 (high), 2026-10-02: Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift  nodejs and D lang bindings.…
• CVE-2026-85476 - CVSS 8.2 (high), 2026-10-02: Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users…
• CVE-2026-96289 - CVSS 8.2 (high), 2026-10-02: Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to…
• CVE-2026-96287 - CVSS 8.2 (high), 2026-10-02: Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to…
• CVE-2026-96286 - CVSS 8.2 (high), 2026-10-02: Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version…
• CVE-2026-96277 - CVSS 8.7 (high), 2026-10-02: Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0.…
• CVE-2026-94658 - CVSS 8.7 (high), 2026-10-02: Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to…
• CVE-2026-94657 - CVSS 8.2 (high), 2026-10-02: Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users…
• CVE-2026-94656 - CVSS 8.2 (high), 2026-10-02: Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
• CVE-2026-94655 - CVSS 8.2 (high), 2026-10-02: Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects…
• CVE-2026-94654 - CVSS 8.2 (high), 2026-10-02: Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users…
• CVE-2026-94653 - CVSS 8.2 (high), 2026-10-02: Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to…
• CVE-2026-94652 - CVSS 6.3 (medium), 2026-10-02: Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
• CVE-2026-94648 - CVSS 8.2 (high), 2026-10-02: Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
• CVE-2026-94646 - CVSS 8.7 (high), 2026-10-02: Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype…
• CVE-2026-94638 - CVSS 6.3 (medium), 2026-10-02: Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
• CVE-2026-94637 - CVSS 8.2 (high), 2026-10-02: Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0.…
• CVE-2026-94636 - CVSS 8.2 (high), 2026-10-02: Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified…
• CVE-2026-92834 - CVSS 6.3 (medium), 2026-10-02: Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before…
• CVE-2026-90440 - CVSS 8.2 (high), 2026-10-02: Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D…
• CVE-2026-87117 - CVSS 8.7 (high), 2026-10-02: NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to…
• CVE-2026-86537 - CVSS 8.7 (high), 2026-10-02: Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language…
• CVE-2026-86536 - CVSS 6.3 (medium), 2026-10-02: Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects…
• CVE-2026-86535 - CVSS 8.7 (high), 2026-10-02: Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution')…
• CVE-2026-85088 - CVSS 6.9 (medium), 2026-10-02: Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client…
• CVE-2026-85087 - CVSS 6.9 (medium), 2026-10-02: Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0.…
• CVE-2026-85086 - CVSS 6.9 (medium), 2026-10-02: Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache…
• CVE-2026-82459 - CVSS 8.2 (high), 2026-10-02: Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift:…
• CVE-2026-82458 - CVSS 8.7 (high), 2026-10-02: Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang,…
• CVE-2026-96288 - CVSS 8.2 (high), 2026-10-02: Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift:…
• CVE-2026-96292 - CVSS 8.2 (high), 2026-10-02: Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift:…
• CVE-2026-96294 - CVSS 8.7 (high), 2026-10-02: Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before…
• CVE-2026-61373 - CVSS 8.7 (high), 2026-10-02: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before…
• CVE-2026-96990 - CVSS 8.2 (high), 2026-10-02: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users…
• CVE-2026-94642 - CVSS 8.7 (high), 2026-10-02: Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version…
• CVE-2026-94644 - CVSS 8.2 (high), 2026-10-02: Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
• CVE-2026-94645 - CVSS 8.2 (high), 2026-10-02: Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This…
• CVE-2026-94650 - CVSS 8.2 (high), 2026-10-02: Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to…
• CVE-2026-94651 - CVSS 8.2 (high), 2026-10-02: improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue…
• CVE-2026-85483 - CVSS 6.3 (medium), 2026-10-02: Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0.…
• CVE-2026-85493 - CVSS 8.7 (high), 2026-10-02: Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to…
• CVE-2026-85494 - CVSS 8.7 (high), 2026-10-02: Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value,…
• CVE-2026-91135 - CVSS 9.2 (critical), 2026-10-02: Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends,…
• CVE-2026-91137 - CVSS 8.7 (high), 2026-10-02: Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift…
• CVE-2026-93925 - CVSS 8.7 (high), 2026-10-02: Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before…
• CVE-2026-93926 - CVSS 8.7 (high), 2026-10-02: Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This…
• CVE-2026-94633 - CVSS 8.7 (high), 2026-10-02: Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue…
• CVE-2026-94634 - CVSS 8.2 (high), 2026-10-02: Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings.…
• CVE-2026-94639 - CVSS 8.2 (high), 2026-10-02: improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java…
• CVE-2026-94635 - CVSS 8.7 (high), 2026-10-02: Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This…
• CVE-2026-66053 - CVSS 5.9 (medium), 2026-07-27: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users…
• CVE-2026-58662 - CVSS 9.1 (critical), 2026-07-27: Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before…
• CVE-2026-58389 - CVSS 8.7 (high), 2026-07-27: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are…
• CVE-2026-58023 - CVSS 9.1 (critical), 2026-07-27: Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to…
• CVE-2026-55971 - CVSS 9.8 (critical), 2026-07-27: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to…
• CVE-2026-55970 - CVSS 6.9 (medium), 2026-07-27: Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version…
• CVE-2026-55969 - CVSS 8.7 (high), 2026-07-27: Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before…
• CVE-2026-55968 - CVSS 8.7 (high), 2026-07-27: Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects…
• CVE-2026-49158 - CVSS 7.5 (high), 2026-07-27: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before…
• CVE-2026-48586 - CVSS 8.7 (high), 2026-07-27: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects…
• CVE-2026-48145 - CVSS 8.2 (high), 2026-07-27: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are…
• CVE-2026-48144 - CVSS 9.1 (critical), 2026-07-27: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users…
• CVE-2026-45112 - CVSS 7.5 (high), 2026-07-27: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before…
• CVE-2026-43871 - CVSS 8.7 (high), 2026-07-27: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift:…
• CVE-2026-41608 - CVSS 7.5 (high), 2026-07-27: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before…
• CVE-2026-43868 - CVSS 7.5 (high), 2026-05-05: Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade…
• CVE-2026-43870 - CVSS 7.3 (high), 2026-05-05: Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP…
• CVE-2026-43869 - CVSS 7.3 (high), 2026-05-05: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended…
• CVE-2026-41602 - CVSS 7.5 (high), 2026-04-28: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.…
• CVE-2026-41606 - CVSS 7.5 (high), 2026-04-28: Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0,…
• CVE-2026-41605 - CVSS 7.7 (high), 2026-04-28: Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version…
• CVE-2026-41636 - CVSS 8.7 (high), 2026-04-28: Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to…
• CVE-2026-41604 - CVSS 8.2 (high), 2026-04-28: Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which…
• CVE-2026-41607 - CVSS 9.1 (critical), 2026-04-28: Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which…
• CVE-2025-48431 - CVSS 7.5 (high), 2026-04-28: Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are…
• CVE-2018-11798 - CVSS 6.5 (medium), 2019-01-07: The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user…
• CVE-2018-1320 - CVSS 7.5 (high), 2019-01-07: Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…
• CVE-2016-5397 - CVSS 8.8 (high), 2018-02-12: The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected…