2710 matches found
CVE-2023-34051
CVE-2023-34051 CVE-2023-34051 is an authentication bypass that bypasses the patch for VMSA-2023-0001. VMSA-2023-0001 for vRealize Log Insight includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control...
CVE-2026-120135
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
CVE-2026-84161 Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics
When an operator enables store.analysisstatisticsdir, a network client with PRODUCTSTORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to...
CVE-2026-84161
CodeChecker 6.29.0 is vulnerable to an authenticated remote denial of service (DoS) due to unbounded zlib decompression in the storeAnalysisStatistics Thrift-over-HTTP method. If an operator enables store.analysis_statistics_dir , a network client with PRODUCT_STORE permissions can provide an att...
EUVD-2026-118186
When an operator enables store.analysisstatisticsdir, a network client with PRODUCTSTORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to...
CVE-2026-121824
A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service...
CVE-2026-121824
A vulnerability exists in armeria versions prior to 1.43.0 . The flaw is triggered by processing malformed Thrift messages , which leads to excessive memory allocation . This condition can potentially result in a denial of service (DoS). No specific exploit details or remediation steps are provid...
CVE-2026-121824
A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service...
CVE-2026-121824
A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service...
CVE-2026-85245
A flaw was found in the Apache Camel Thrift component, which can lead to information disclosure. When processing incoming messages, the component unmarshals data into a shared process-wide object rather than creating a fresh instance for each exchange. Consequently, data from earlier or concurren...
thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound
A flaw was found in Apache Thrift's C++, cglib, Go, netstd, Delphi, and Haxe bindings. This integer overflow or wraparound vulnerability allows a remote attacker to cause a denial of service DoS by sending specially crafted input. The flaw can lead to the affected service becoming unavailable...
Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - thrift
Security scans report the following CVEs, all of which have IMPORTANT impact: - CVE-2026-43871 - CVE-2026-55969 RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...
thrift: Apache Thrift: Denial of Service via infinite loop
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...
RUSTSEC-2026-0435 Unbounded memory allocation in `thrift` binary protocol `read_bytes`
Affected versions of the thrift crate size a buffer directly from an attacker-controlled 4-byte length read off the wire, before reading any payload and with no upper bound, allowing a hostile peer to force a large eager allocation or an immediate abort denial of service, CWE-400 / CWE-789. This ...
amadeus-parquet (>=0.1.3, <=0.3.1), arrow-digest (0.7.0) +80 more potentially affected by CVE-2026-43868 via thrift (>=0.0.4, <=0.17.0)
thrift CARGO version =0.0.4, =0.1.3, =0.1.0, =0.9.7, =0.2.3, =0.1.0, =4.0.0, =7.0.0-alpha, =7.0.0-alpha, =0.1.0, =0.2.1, =0.1.0, =0.3.2-rc1, =0.1.0, =2.1.1 and more Source cves: CVE-2026-43868 Source advisory: OSV:RUSTSEC-2026-0435...
Unbounded memory allocation in `thrift` binary protocol `read_bytes`
Affected versions of the thrift crate size a buffer directly from an attacker-controlled 4-byte length read off the wire, before reading any payload and with no upper bound, allowing a hostile peer to force a large eager allocation or an immediate abort denial of service, CWE-400 / CWE-789. This ...
CVE-2023-20887
CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ Summary...
vRealizeLogInsightRCE
VMSA-2023-0001 POC for VMSA-2023-0001 affecting VMware vRealize Log Insight which includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control Vulnerability CVE-2022-31704 VMware vRealize Log Insight...
DEBIAN-CVE-2026-120135
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...