Vigie VulnDBEuropean-hosted Vulnerability DB

Apache Software Foundation Apache Thrift

89 published vulnerabilities name this product.

As the CNAs write it in their CVE records (vendor and product); the versions are theirs.

CVEVulnerable versionsTitleSeverityPublishedEPSSExploitation
CVE-2026-66054< 0.25.0Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSizeMEDIUM 6.90.3 %
CVE-2026-61374< 0.25.0Apache Thrift: Java TSaslTransport post-auth data-frame missing size limitHIGH 7.10.2 %
CVE-2026-63772< 0.25.0Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform countHIGH 8.70.3 %
CVE-2026-66055< 0.25.0Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/numb…HIGH 8.20.3 %
CVE-2026-66081< 0.25.0Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messagesHIGH 8.70.3 %
CVE-2026-66331< 0.25.0Apache Thrift: Buffered transport reads are not accounted against MaxMessageSizeMEDIUM 6.90.3 %
CVE-2026-66837< 0.25.0Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string lengthHIGH 8.70.3 %
CVE-2026-66858< 0.25.0Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Pyth…HIGH 8.70.3 %
CVE-2026-66859< 0.25.0Apache Thrift: c_glib multiplexed processor crashes on a message it cannot routeHIGH 8.70.3 %
CVE-2026-83632< 0.25.0Apache Thrift: C++ THttpTransport grows its line buffer without boundCRITICAL 9.20.3 %
CVE-2026-83663< 0.25.0Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)HIGH 8.70.3 %
CVE-2026-83745< 0.25.0Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node…HIGH 8.70.3 %
CVE-2026-85476< 0.25.0Apache Thrift: c_glib `read_all` spins when the underlying read returns 0HIGH 8.20.3 %
CVE-2026-96289< 0.25.0Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guardHIGH 8.20.3 %
CVE-2026-96287< 0.25.0Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)HIGH 8.20.3 %
CVE-2026-96286< 0.25.0Apache Thrift: Perl servers end `serve()` when serving one connection failsHIGH 8.20.3 %
CVE-2026-96277< 0.25.0Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exceptionHIGH 8.70.3 %
CVE-2026-94658< 0.25.0Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)HIGH 8.70.3 %
CVE-2026-94657< 0.25.0Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size boundHIGH 8.20.3 %
CVE-2026-94656< 0.25.0Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size boundHIGH 8.20.3 %
CVE-2026-94655< 0.25.0Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadraticHIGH 8.20.3 %
CVE-2026-94654< 0.25.0Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frameHIGH 8.20.3 %
CVE-2026-94653< 0.25.0Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)HIGH 8.20.3 %
CVE-2026-94652< 0.25.0Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling backMEDIUM 6.30.3 %
CVE-2026-94648< 0.25.0Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size boundHIGH 8.20.3 %
CVE-2026-94646< 0.25.0Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)HIGH 8.70.3 %
CVE-2026-94638< 0.25.0Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`MEDIUM 6.30.3 %
CVE-2026-94637< 0.25.0Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frameHIGH 8.20.3 %
CVE-2026-94636< 0.25.0Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used upHIGH 8.20.3 %
CVE-2026-92834< 0.25.0Apache Thrift: C++ WebSocket server transport does not read a full request lengthMEDIUM 6.30.3 %
CVE-2026-90440< 0.25.0Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote at…HIGH 8.20.3 %
CVE-2026-87117< 0.25.0Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element specHIGH 8.70.3 %
CVE-2026-86537< 0.25.0Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny serviceHIGH 8.70.4 %
CVE-2026-86536< 0.25.0Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScriptMEDIUM 6.30.3 %
CVE-2026-86535< 0.25.0Apache Thrift: A JSON member name can stall the Node server's event loop indefinitelyHIGH 8.70.4 %
CVE-2026-85088< 0.25.0Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but …MEDIUM 6.90.2 %
CVE-2026-85087< 0.25.0Apache Thrift: Python ≥3.12 host-name check silently becomes a no-opMEDIUM 6.90.2 %
CVE-2026-85086< 0.25.0Apache Thrift: Perl TLS client disables certificate verification by defaultMEDIUM 6.90.2 %
CVE-2026-82459< 0.25.0Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit processHIGH 8.20.3 %
CVE-2026-82458< 0.25.0Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Ap…HIGH 8.70.3 %
CVE-2026-96288< 0.25.0Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)HIGH 8.20.3 %
CVE-2026-96292< 0.25.0Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)HIGH 8.20.3 %
CVE-2026-96294< 0.25.0Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connectionHIGH 8.70.3 %
CVE-2026-61373< 0.25.0Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocationHIGH 8.70.4 %
CVE-2026-96990< 0.25.0Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size boundHIGH 8.20.4 %
CVE-2026-94642< 0.25.0Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exceptionHIGH 8.70.4 %
CVE-2026-94644< 0.25.0Apache Thrift: PHP `TJSONProtocol` string/number readers have no size boundHIGH 8.20.3 %
CVE-2026-94645< 0.25.0Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop boundHIGH 8.20.3 %
CVE-2026-94650< 0.25.0Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)HIGH 8.20.3 %
CVE-2026-94651< 0.25.0Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse errorHIGH 8.20.3 %
CVE-2026-85483< 0.25.0Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream endMEDIUM 6.30.3 %
CVE-2026-85493< 0.25.0Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)HIGH 8.70.3 %
CVE-2026-85494< 0.25.0Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Fr…HIGH 8.70.3 %
CVE-2026-91135< 0.25.0Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)CRITICAL 9.20.3 %
CVE-2026-91137< 0.25.0Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elementsHIGH 8.70.3 %
CVE-2026-93925< 0.25.0Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol idHIGH 8.70.3 %
CVE-2026-93926< 0.25.0Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error pathHIGH 8.70.3 %
CVE-2026-94633< 0.25.0Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name lengthHIGH 8.70.3 %
CVE-2026-94634< 0.25.0Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by defaultHIGH 8.20.3 %
CVE-2026-94639< 0.25.0Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)HIGH 8.20.3 %
CVE-2026-94635< 0.25.0Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned nameHIGH 8.70.3 %
CVE-2026-66053< 0.24.0Apache Thrift: Python TSSLSocket Hostname Matcher ImportMEDIUM 5.90.3 %
CVE-2026-58662< 0.24.0Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassHIGH 8.71.1 %
CVE-2026-58389< 0.24.0Apache Thrift: Rust binary protocol non-strict path missing string size limitHIGH 8.71.0 %
CVE-2026-58023< 0.24.0Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes pathMEDIUM 6.91.0 %
CVE-2026-55971< 0.24.0Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()CRITICAL 9.31.0 %
CVE-2026-55970< 0.24.0Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()MEDIUM 6.90.8 %
CVE-2026-55969< 0.24.0Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAv…HIGH 8.71.0 %
CVE-2026-55968< 0.24.0Apache Thrift: Node.js quadratic-time DoS in server receive transportsHIGH 8.71.0 %
CVE-2026-49158< 0.24.0Apache Thrift: Ruby THeaderTransport ZLIB Decompression BombHIGH 7.51.0 %
CVE-2026-48586< 0.24.0Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size LimitHIGH 8.71.0 %
CVE-2026-48145< 0.24.0Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard BypassHIGH 8.20.4 %
CVE-2026-48144< 0.24.0Apache Thrift: c_glib TLS Client Missing Hostname VerificationCRITICAL 9.10.4 %
CVE-2026-451120.19.0 – < 0.24.0Apache Thrift: Unbounded Read Leading to Denial of ServiceMEDIUM 6.91.0 %
CVE-2026-43871< 0.24.0Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limitHIGH 8.71.0 %
CVE-2026-41608< 0.24.0Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransportHIGH 7.51.0 %
CVE-2026-43868< 0.23.0Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternHIGH 7.50.7 %
CVE-2026-43870< 0.23.0Apache Thrift: Node.js web_server.js multi-vulnerabilityHIGH 7.30.4 %
CVE-2026-43869< 0.23.0Apache Thrift: TSSLTransportFactory.java hostname verificationHIGH 7.30.6 %
CVE-2026-41636< 0.23.0Apache Thrift: Node.js skip() recursionHIGH 8.70.5 %
CVE-2026-41607< 0.23.0Apache Thrift: C++ JSON OOB readCRITICAL 9.10.9 %
CVE-2026-41606< 0.23.0Apache Thrift: c_glib dispatch stack overflowHIGH 7.51.1 %
CVE-2026-41605< 0.23.0Apache Thrift: Swift Compact Protocol integer overflowHIGH 7.70.9 %
CVE-2026-41604< 0.23.0Apache Thrift: Swift Range crash in skip()HIGH 8.20.9 %
CVE-2026-41602< 0.23.0Apache Thrift: Go TFramedTransport uint32 overflowHIGH 7.51.2 %
CVE-2025-48431< 0.23.0Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.HIGH 7.51.0 %
CVE-2018-1320Apache Thrift 0.5.0 to 0.11.0Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.tHIGH 7.58.2 %
CVE-2018-11798Apache Thrift 0.9.2 to 0.11.0The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in whiMEDIUM 6.54.7 %
CVE-2016-5397versions prior to 0.10.0The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tHIGH 8.86.9 %