CVE-2023-20887

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://kushagraojha.medium.com/vmware-vrealize-network-insight-cve-2023-20887-193f3c3d30a0...

CVE-2026-120135

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound

A flaw was found in Apache Thrift's C++, cglib, Go, netstd, Delphi, and Haxe bindings. This integer overflow or wraparound vulnerability allows a remote attacker to cause a denial of service DoS by sending specially crafted input. The flaw can lead to the affected service becoming unavailable...

thrift: Apache Thrift: Denial of Service via infinite loop

A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...

DEBIAN-CVE-2026-120135

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-120135

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-120135 Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

EUVD-2026-114735

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-120135

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-120135

The Apache Thrift Java bindings versions before 0.24.0 are vulnerable to an uncontrolled recursion vulnerability in the TProtocolUtil.skip() method. The root cause is that the method does not limit recursion depth by default, which can lead to a high availability impact (as indicated by the CVSS ...

CLEANSTART-2026-FX55843 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

CVE-2026-41602 affects multiple packages. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0. See references for individual vulnerability details...

CLEANSTART-2026-UI66796 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift

Security vulnerability affects the druid-fips package. Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift...

PT-2026-134679

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An uncontrolled recursion flaw exists in the Java bindings of Apache Thrift. Uncontrolled recursion occurs when a program calls itself repeatedly without a proper termination condition, which...

CVE-2026-120135: Apache Software Foundation Apache Thrift: Uncontrolled Recursion vulnerability in Apache Thrift Java bindings

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CLEANSTART-2026-NG24474 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the amazon-cloudwatch-agent package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-ZS21302 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the temporal-server-fips package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLEANSTART-2026-RF19497 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings

Security vulnerability affects the spark-sc213-jdk17-py312 package. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings...

CLEANSTART-2026-YL88811 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings

Security vulnerability affects the spark-sc213-jdk17-py312 package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...

CLEANSTART-2026-LR97192 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the vault package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-6733 DESCRIPTION: Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstre...