AZL-105410 CVE-2026-94636 affecting package thrift 0.24.0-1

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

DEBIAN-CVE-2026-94636

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-106026 CVE-2026-82458 affecting package kata-containers-preview 3.27.0~preview2-2

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-106491 CVE-2026-82458 affecting package influxdb 2.7.5-21

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

UBUNTU-CVE-2026-94652

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-94648

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85088

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

@0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1), @514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64) +772 more potentially affected by CVE-2026-83745 via thrift (>=0.9.2, <=0.24.0)

thrift NPM version =0.9.2, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.0-dev, =1.0.0, =0.9.0, =0.0.0-186649, =0.0.0-06d7fc, =0.3.0, =0.0.1, =0.2.0, =0.2.0, =0.2.4 and more Source cves: CVE-2026-83745 Source advisory: MEND:CVE-2026-83745...

RUSTSEC-2026-0319 anymap2 is unmaintained

The anymap2 crate is not maintained. anymap3 is the recommended replacement...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-94636 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-94636 Source advisory: MEND:CVE-2026-94636...

CLSA-2026-1790941624 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.4-tuxcare.4...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to improper exception handling in the TNonblockingServer. An attacker can disrupt server availability by sending specially crafted requests that trigger unhandled exceptions, resulting in the termination of the...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the D language bindings. An attacker can cause the application to enter an infinite loop or terminate unexpectedly by sending specially crafted input that triggers an integer underflow or an unhandled exception...

@0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1), @514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64) +701 more potentially affected by CVE-2026-86535 via thrift (>=0.10.0, <=0.24.0)

thrift NPM version =0.10.0, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.0-dev, =1.0.0, =0.9.0, =0.0.0-186649, =0.0.0-06d7fc, =0.3.0, =0.0.1, =0.2.0, =0.2.0, =0.2.4 and more Source cves: CVE-2026-86535 Source advisory: MEND:CVE-2026-86535...

CVE-2026-104432 Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtaintips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK...

CVE-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

CVE-2026-85088

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

CVE-2026-85088

The Apache Thrift C++ (0.7.0 through 0.24.0) and D (0.9.0 through 0.24.0) libraries are vulnerable to an improper certificate validation flaw during TLS connections. The default access managers (TSSLSocketFactory in C++ and accessManager in D) fail to reject certificates when subjectAltName dNSNa...

CVE-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via improper evaluation of the certificate's Common Name during TLS certificate validation when subject alternative name entries do not match the target host. An attacker can intercept or tamper with...