ai.chatur:cortex-core (>=0.0.1, <=0.1.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +6583 more potentially affected by CVE-2026-61374 via org.apache.thrift:libthrift (>=0.6.1, <=0.24.0)

org.apache.thrift:libthrift MAVEN version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =chaining-0.0.46-de...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-66055 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-66055 Source advisory: MEND:CVE-2026-66055...

ai.chatur:cortex-core (>=0.0.1, <=0.1.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +6583 more potentially affected by CVE-2026-66055 via org.apache.thrift:libthrift (>=0.6.1, <=0.24.0)

org.apache.thrift:libthrift MAVEN version =0.6.1, =0.0.1, =0.0.1, =0.0.1, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =chaining-0.0.46-de...

Access of Uninitialized Pointer

Overview Affected versions of this package are vulnerable to Access of Uninitialized Pointer in the cglib bindings when processing specially crafted input that leads to access of an uninitialized pointer. An attacker can cause the application to crash by sending malicious data to the affected...

CLSA-2026-1790944177 TuxCare security update for js-yaml (2 CVEs)

TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.2.0-tuxcare.2...

CVE-2026-66858

Apache Thrift versions before 0.25.0 are vulnerable to a Denial of Service (DoS) attack due to a flaw in the protocol skip routine. Specifically, multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can...

CVE-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

EUVD-2026-91585

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CLSA-2026-1790944047 TuxCare security update for org.apache.logging.log4j (3 CVEs)

TuxCare rebuilt 34 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.19.0-tuxcare.1...

AZL-105410 CVE-2026-94636 affecting package thrift 0.24.0-1

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

DEBIAN-CVE-2026-94636

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-106026 CVE-2026-82458 affecting package kata-containers-preview 3.27.0~preview2-2

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AZL-106491 CVE-2026-82458 affecting package influxdb for versions less than 2.7.5-21

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

UBUNTU-CVE-2026-94652

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85088

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

UBUNTU-CVE-2026-94648

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

@0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1), @514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64) +789 more potentially affected by CVE-2026-83745 via thrift (>=0.9.2, <=0.24.0)

thrift NPM version =0.9.2, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.0-dev, =1.0.0, =0.9.0, =0.0.0-186649, =0.0.0-06d7fc, =0.3.0, =0.0.1, =0.2.0, =0.2.0, =0.2.4 and more Source cves: CVE-2026-83745 Source advisory: MEND:CVE-2026-83745...

RUSTSEC-2026-0319 anymap2 is unmaintained

The anymap2 crate is not maintained. anymap3 is the recommended replacement...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-94636 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-94636 Source advisory: MEND:CVE-2026-94636...