AZL-105950 CVE-2026-66858 affecting package thrift 0.24.0-1

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

UBUNTU-CVE-2026-83632

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the decompression. An attacker can exhaust system resources and render the service unavailable by sending specially crafted, highly compressed data payloads. Remediation...

Access of Uninitialized Pointer

Overview Affected versions of this package are vulnerable to Access of Uninitialized Pointer in the cglib bindings when processing specially crafted input that leads to access of an uninitialized pointer. An attacker can cause the application to crash by sending malicious data to the affected...

CLSA-2026-1790944177 TuxCare security update for js-yaml (2 CVEs)

TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.2.0-tuxcare.2...

CVE-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858

Apache Thrift versions before 0.25.0 are vulnerable to a Denial of Service (DoS) attack due to a flaw in the protocol skip routine. Specifically, multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can...

EUVD-2026-91585

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CLSA-2026-1790944047 TuxCare security update for org.apache.logging.log4j (3 CVEs)

TuxCare rebuilt 34 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.19.0-tuxcare.1...

AZL-105410 CVE-2026-94636 affecting package thrift 0.24.0-1

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

DEBIAN-CVE-2026-94636

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-106026 CVE-2026-82458 affecting package kata-containers-preview 3.27.0~preview2-2

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-106491 CVE-2026-82458 affecting package influxdb 2.7.5-21

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

UBUNTU-CVE-2026-94648

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-94652

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

RUSTSEC-2026-0319 anymap2 is unmaintained

The anymap2 crate is not maintained. anymap3 is the recommended replacement...

CLSA-2026-1790941624 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.4-tuxcare.4...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to improper exception handling in the TNonblockingServer. An attacker can disrupt server availability by sending specially crafted requests that trigger unhandled exceptions, resulting in the termination of the...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the D language bindings. An attacker can cause the application to enter an infinite loop or terminate unexpectedly by sending specially crafted input that triggers an integer underflow or an unhandled exception...