PT-2026-104332

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An allocation of resources without limits or throttling issue exists in the Apache Thrift Go bindings. This can lead to an unauthenticated single-packet crash of Go Thrift servers through the...

PT-2026-104334

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An allocation of resources without limits or throttling issue exists in the C++, Java, Go, netstd, Python, and Delphi bindings. Specifically, the TJSONProtocol accepts a single JSON string or...

PT-2026-104322

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the Apache Thrift Delphi bindings buffered transport where resources are allocated without limits or throttling. This can lead to excessive resource consumption...

PT-2026-104285

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Language bindings for Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D fail to cap size fields during deserialization. This allows a remote client to send an excessively large...

PT-2026-104310

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the Apache Thrift ruby bindings where resources are allocated without limits or throttling. This can lead to excessive resource consumption. Recommendations Update to versio...

CVE-2026-85494: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

CVE-2026-91137: Improper Validation of Specified Quantity in Input

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94644: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104207

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Dart bindings contain an issue involving improper handling of length parameter inconsistency, which can lead to memory allocation with an excessive size value. Recommendations...

PT-2026-104181

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Improper handling of length parameter inconsistency and allocation of resources without limits or throttling in Apache Thrift Lua bindings. Specifically, the TBinaryProtocol:readMessageBegin...

PT-2026-104305

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the Apache Thrift dart bindings where resources are allocated without limits or throttling. This can lead to excessive resource consumption. Recommendations Update to versio...

CVE-2026-66055: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104301

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Improper handling of length parameter inconsistency in the Node.js and D language bindings allows for memory allocation with excessive size values. The WebSocket server transports in both...

PT-2026-104167

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

PT-2026-104215

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Erlang bindings contain an issue involving uncontrolled recursion and the allocation of resources without limits or throttling. Recommendations Upgrade to version 0.25.0...

CVE-2026-96288: Uncontrolled Recursion

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94634: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Super Stream Binding Keys Denial of Service

The version of RabbitMQ installed on the remote host is 4.1.x prior to 4.1.11, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by a denial of service vulnerability: - The stream management HTTP API handler for super stream creation PUT...

ImageMagick < 6.9.13-40 / 7.x < 7.1.2-15 Vulnerability

The remote host has a version of ImageMagick installed that is prior to 6.9.13-40, or 7.x prior to 7.1.2-15. It is, therefore, affected by a vulnerability. - ImageMagick before 7.1.2-15 and before 6.9.13-40 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCac...