CVE-2023-20887

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ Summary...

CVE-2023-34051

CVE-2023-34051 CVE-2023-34051 is an authentication bypass that bypasses the patch for VMSA-2023-0001. VMSA-2023-0001 for vRealize Log Insight includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control...

CVE-2026-86536

A flaw was found in Apache Thrift's JavaScript bindings. An unauthenticated remote attacker can exploit a prototype pollution vulnerability—where shared JavaScript object definitions are modified—by sending specially crafted input to an application using the affected bindings. Successful...

CVE-2026-94652

A flaw was found in Apache Thrift's C++ bindings. A remote attacker can cause a Denial of Service DoS by exploiting a memory leak where allocated system memory is not properly released after use. Over time, repeated requests can exhaust available memory and lead to service instability...

readable-thrift

Readable Thrift Readable Thrift makes binary Thrift protocol messages easy to work with by converting them to and from a human-friendly format. This makes manual analysis of and tampering with binary format Thrift messages just as easy as working with plaintext protocols like HTTP. The library is...

vRealizeLogInsightRCE

VMSA-2023-0001 POC for VMSA-2023-0001 affecting VMware vRealize Log Insight which includes the following CVEs: VMware vRealize Log Insight Directory Traversal Vulnerability CVE-2022-31706 VMware vRealize Log Insight broken access control Vulnerability CVE-2022-31704 VMware vRealize Log Insight...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

CLEANSTART-2026-AL15636 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

CVE-2026-82458 affects multiple packages. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. See references for individual vulnerabilit...

CLEANSTART-2026-GN57450 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

CVE-2026-43871 affects multiple packages. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings. See references for individual vulnerability details...

Resource Exhaustion

Apache Thrift is vulnerable to resource exhaustion. The vulnerability is due to unbounded allocation of resources without proper throttling, where the Java bindings perform resource allocation without limits and attackers can trigger excessive resource consumption to cause denial of service...

CLEANSTART-2026-YM59079 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

Security vulnerability affects the grafana package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings...

CVE-2026-91135

A flaw was found in Apache Thrift. A remote attacker can exploit a heap-based buffer overflow in the C++ transport component to achieve arbitrary code execution or cause a Denial of Service DoS through an application crash. The vulnerability occurs when an application enables compression transfor...

CVE-2026-85086 affecting package thrift for versions less than 0.25.0-1

CVE-2026-85086 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-83663 affecting package thrift for versions less than 0.25.0-1

CVE-2026-83663 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-94638 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94638 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-85493 affecting package thrift for versions less than 0.25.0-1

CVE-2026-85493 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-94646 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94646 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-94658 affecting package thrift for versions less than 0.25.0-1

CVE-2026-94658 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-83745 affecting package thrift for versions less than 0.25.0-1

CVE-2026-83745 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-66858 affecting package thrift for versions less than 0.25.0-1

CVE-2026-66858 affecting package thrift for versions less than 0.25.0-1. An upgraded version of the package is available that resolves this issue...