Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

...

Infinite loop

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by...

Infinite loop

Overview ApacheThrift is a Thrift client library for Microsoft .NET Standard Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing...

Infinite loop

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by sending a...

Infinite loop

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by sending a TCompactProtocol varint whose continuation b...

Infinite loop

Overview thrift is a Ruby bindings package for Apache Thrift. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by...

Infinite loop

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang t...

CVE-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PT-2026-37330

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=506318134 Crash type: Security exception Crash state: org.apache.thrift.protocol.TProtocolUtil.skip org.apache.thrift.protocol.TCompactProtocol.readByte org.apache.thrift.protocol.TCompactProtocol.readFieldBegin...

thrift-java:ParseCompactFuzzer: Security exception in org.apache.thrift.protocol.TProtocolUtil.skip

Detailed Report: https://oss-fuzz.com/testcase?key=6326522100383744 Project: thrift-java Fuzzing Engine: libFuzzer Fuzz Target: ParseCompactFuzzer Job Type: libfuzzerasanthrift-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

OSV-2025-901 Heap-use-after-free in apache::thrift::protocol::TCompactProtocolT<apache::thrift::transport::TMemoryBu

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=461058054 Crash type: Heap-use-after-free READ 1 Crash state: apache::thrift::protocol::TCompactProtocolTapache::thrift::transport::TMemoryBu unsigned int parquet::format::OffsetIndex::readapache::thrift::protocol::TCompa void...

PT-2020-21929

Name of the Vulnerable Software and Affected Versions Apache Thrift affected versions not specified parquet affected versions not specified Description The issue is related to a crash in the Apache Thrift protocol, specifically in the TCompactProtocol. The crash occurs when reading a Parquet file...