Linux Distros Unpatched Vulnerability : CVE-2026-49158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0...

PT-2026-65541

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

CVE-2026-54619: Use After Free

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

DEBIAN-CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

CVE-2026-49158 describes an Improper Handling of Highly Compressed Data (Data Amplification) in the Apache Thrift Ruby bindings (THeaderTransport). The issue affects Thrift versions before 0.24.0. The vulnerability allows amplification of data via ZLIB decompression, which can impact availability...

EUVD-2026-49151

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview thrift is a Ruby bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ZLIB transform in lib/rb/lib/thrift/transport/headertransport.rb. An attacker can trigger memory and CPU...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PT-2026-64883

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Ruby bindings. This issue occurs during ZLIB decompression within the THeaderTransport...

OESA-2022-1752 rubygem-yajl-ruby security update

Ruby C bindings to the excellent Yajl JSON stream-based parser library. Security Fixes: yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing wit...

HTTP Request Smuggling

Overview llhttp is a set of Ruby bindings for llhttp. Affected versions of this package are vulnerable to HTTP Request Smuggling. The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. Remediation There is no fixed version for llhttp. References -...

HTTP Request Smuggling

Overview llhttp is a set of Ruby bindings for llhttp. Affected versions of this package are vulnerable to HTTP Request Smuggling when the llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. Remediation A fix was pushed into the master branch but not y...