CVE-2026-82458 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-82458

The Apache Thrift framework is vulnerable to a Denial of Service (DoS) condition in multiple language bindings, including Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D . The root cause is a failure to properly restrict memory allocation when processing input containing excessi...

AZL-105392 CVE-2026-93925 affecting package thrift 0.24.0-1

Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the C GLib bindings. An attacker can cause the application to crash by sending specially crafted input that triggers excessive nested function calls, leading to stack...

CVE-2026-93925

A flaw was found in Apache Thrift. An incorrect bitwise integer shift in the C++ THeaderProtocol implementation can cause a stack-based buffer overflow. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, resulting in a Denial of Service DoS...

CVE-2026-91135 Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as...

CVE-2026-93925

Apache Thrift versions before 0.25.0 are vulnerable to a stack-based buffer overflow caused by an incorrect bitwise integer shift within the C++ THeaderProtocol implementation. Specifically, the flaw exists in the THeaderTransport::writeVarint32() function when processing a negative protocol ID. ...

MGASA-2026-0467 Updated python-tornado packages fix security vulnerabilities

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit gzip bomb...

CVE-2026-94652: Missing Release of Memory after Effective Lifetime

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66858: Uncontrolled Recursion

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66054: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-92834: Use of Uninitialized Resource

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104333

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift C++ bindings contain an issue where the C++ THeaderTransport does not enforce the configured maxFrameSize. This leads to the allocation of resources without limits or throttling...

PT-2026-104334

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An allocation of resources without limits or throttling issue exists in the C++, Java, Go, netstd, Python, and Delphi bindings. Specifically, the TJSONProtocol accepts a single JSON string or...

PT-2026-104198

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The c glib bindings in Apache Thrift contain an issue involving the use of an uninitialized resource and the return of an incorrect status code. Recommendations Update to version 0.25.0...

PT-2026-104306

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description A memory leak occurs in the Apache Thrift C++ bindings due to a missing release of memory after its effective lifetime. Recommendations Update to version 0.25.0...

CVE-2026-66055: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104303

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description A loop with an unreachable exit condition, resulting in an infinite loop, exists within the c glib bindings. Recommendations Update to version 0.25.0...

PT-2026-104324

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The protocol skip routine in several Apache Thrift bindings fails to apply the recursion limit. This allows a message containing deeply nested unknown fields to exhaust the stack, potentially...

PT-2026-104325

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the c glib bindings involving a NULL pointer dereference and the use of an uninitialized variable. Recommendations Update to version 0.25.0...