Where
-Infinity
0

Trending

Last week
Last month
Last year

Apache ThriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

Risk 50
Severity
8.7
Integer Overflow
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-55969

Apache ThriftApache Thrift: Go TFramedTransport uint32 overflow

Risk 47
Severity
7.5
Integer Overflow
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Thrift: Go TFramedTransport uint32 overflow

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-41602

Apache ThriftApache Thrift: Node.js skip() recursion

Risk 51
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift: Node.js skip() recursion

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-41636

Apache ThriftApache Thrift: TSSLTransportFactory.java hostname verification

Risk 55
Severity
7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

First published (updated )
CVE-2026-43869

Apache ThriftApache Thrift: c_glib dispatch stack overflow

Risk 47
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Apache Thrift: cglib dispatch stack overflow

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-41606

Apache ThriftApache Thrift: C++ JSON OOB read

Risk 71
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Apache Thrift: C++ JSON OOB read

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-41607

Apache ThriftApache Thrift: Swift Compact Protocol integer overflow

Risk 71
Severity
7.7
Integer Overflow
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Apache Thrift: Swift Compact Protocol integer overflow

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-41605

Apache ThriftApache Thrift: Swift Range crash in skip()

Risk 58
Severity
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Out-of-bounds Read vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

First published (updated )
CVE-2026-41604

Apache Thrift c_glibApache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

Risk 47
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Thrift: Specially crafted input can crash a cglib Thrift server with invalid pointer error.

1 / 2
Source: Microsoft
First published (updated )
CVE-2025-48431

Apache ThriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

Risk 50
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-43871

Apache ThriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

Risk 51
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-48586

Apache ThriftApache Thrift: Java TSSLTransportFactory hostname verification

Risk 62
Severity
7.4
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Apache Thrift: Java TSSLTransportFactory hostname verification

1 / 3
Source: Microsoft
First published (updated )
CVE-2026-41603

Apache ThriftApache Thrift: Node.js web_server.js multi-vulnerability

Risk 55
Severity
7.3
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

First published (updated )
CVE-2026-43870

Apache Thrift (Rust)Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Risk 46
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

First published (updated )
CVE-2026-43868

Apache Thrift Java bindingsApache Thrift: Unbounded Read Leading to Denial of Service

Risk 46
Severity
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.

This issue affects Apache Thrift: from 0.19.0 before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

First published (updated )
CVE-2026-45112

Apache ThriftAllocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. …

Risk 33
Severity
7

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.

This issue affects Apache Thrift: from 0.19.0 before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

First published (updated )
REDHAT-BUG-2507439

Apache ThriftPath Traversal

Risk 33
Severity
7
Path Traversal

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

First published (updated )
REDHAT-BUG-2466671

Apache Thrift (C++ bindings)Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass

Risk 46
Severity
8.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-48145

Apache Apache ThriftApache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

Risk 46
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-41608

Apache ThriftApache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()

Risk 44
Severity
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-55970

Apache Thrift (Python bindings)Apache Thrift: Python TSSLSocket Hostname Matcher Import

Risk 38
Severity
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Thrift: Python TSSLSocket Hostname Matcher Import

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-66053

Apache ThriftApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

Risk 70
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-58662

Apache Apache ThriftApache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

Risk 70
Severity
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift: cglib heap out-of-bounds read in transport leftover-bytes path

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-58023

Apache Apache ThriftApache Thrift: c_glib TLS Client Missing Hostname Verification

Risk 67
Severity
9.1
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift: cglib TLS Client Missing Hostname Verification

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-48144

Apache Thrift (C++ bindings)Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

Risk 91
Severity
9.3
Buffer Overflow
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

1 / 2
Source: Microsoft
First published (updated )
CVE-2026-55971

go/github.com/apache/thriftIn Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProto…

Risk 46
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in Apache Thrift versions 0.9.3 to 0.12.0. A server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

References:

https://seclists.org/oss-sec/2019/q4/29

1 / 3
Source: Red Hat
First published (updated )
CVE-2019-0210

redhat/eap7-activemq-artemisApache Thrift is vulnerable to a denial of service, caused by an error when processing untrusted Thr…

Risk 47
Severity
7.8
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in Apache Thrift up to and including 0.12.0. A server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed by THRIFT-4024 in version 0.11.0, depending on the installed version it affects only certain language bindings.

References:

https://seclists.org/oss-sec/2019/q4/28

1 / 3
Source: Red Hat
First published (updated )
CVE-2019-0205

redhat/thriftInput Validation

Risk 45
Severity
7.5
Input Validation
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

1 / 3
Source: GitHub
First published (updated )
CVE-2018-1320

Apache Apache ThriftApache Thrift: Rust binary protocol non-strict path missing string size limit

Risk 50
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

First published (updated )
CVE-2026-58389

Apache Apache ThriftApache Thrift: Node.js quadratic-time DoS in server receive transports

Risk 50
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

First published (updated )
CVE-2026-55968

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203