CLEANSTART-2026-YY80093 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the minio package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CVE-2023-20887

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://kushagraojha.medium.com/vmware-vrealize-network-insight-cve-2023-20887-193f3c3d30a0...

CVE-2026-85483

A flaw was found in Apache Thrift's C GLib bindings. Due to the use of an uninitialized resource and improper status code handling during request processing, the application can enter an inconsistent state. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS or...

CVE-2026-91137

A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this vulnerability by sending specially crafted input containing improperly validated quantity values. This causes the application to perform excessive iterations and consume memory or CPU resources without limits,...

CVE-2026-87117

A flaw was found in Apache Thrift. A remote attacker could trigger a Denial of Service DoS by submitting specially crafted input to an application utilizing the PHP bindings. This condition causes a null pointer dereference, crashing the service and rendering it unavailable to legitimate users...

CVE-2026-85493

A flaw was found in Apache Thrift's Dart and Java ME bindings. A remote unauthenticated attacker can exploit this flaw by sending specially crafted requests that trigger excessive recursion. This condition can exhaust system resources and crash the application, resulting in a Denial of Service Do...

CVE-2026-85476

A flaw was found in Apache Thrift. A remote attacker could cause a Denial of Service DoS by sending specially crafted input to an application using the C GLib bindings. Processing this malformed data triggers an infinite loop, consuming system resources and causing the application to become...

CVE-2026-63772

A flaw was found in the Apache Thrift Go bindings. A remote attacker can exploit this vulnerability by sending specially crafted requests that trigger excessive resource allocation without proper restrictions. This uncontrolled consumption can exhaust system resources, leading to a Denial of...

CVE-2026-85087

A flaw was found in Apache Thrift's Python bindings. Due to improper certificate validation and incorrect status code handling, client applications fail to properly verify the authenticity of a remote server during encrypted connections. A remote attacker in a man-in-the-middle position could...

CVE-2026-92834

A flaw was found in Apache Thrift. The C++ WebSocket server mishandles uninitialized resources and returns an incorrect status code when processing requests. Under specific conditions, a remote attacker could exploit this vulnerability to trigger improper application states and compromise system...

CVE-2026-94634

A flaw was found in the Apache Thrift Python bindings, which can lead to a Denial of Service DoS. Due to insecure default settings and a lack of limits or throttling on resource allocation, a remote unauthenticated attacker can cause excessive resource consumption. This behavior can exhaust...

CVE-2026-94648

A flaw was found in Apache Thrift. The Dart bindings fail to properly restrict or throttle resource allocation when processing incoming requests. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, causing excessive resource consumption that lea...

CVE-2026-94644

A flaw was found in Apache Thrift's PHP bindings. A remote, unauthenticated attacker can exploit this vulnerability by sending requests that trigger unbounded resource allocation without proper limits or throttling. This failure to control consumption can exhaust system resources, resulting in a...

CVE-2026-94636

A flaw was found in Apache Thrift's Python bindings. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by sending specially crafted input or compressed payloads. Due to improper input validation and improper handling of compressed data, processing these...

CVE-2026-94658

A flaw was found in Apache Thrift Lua bindings. Due to inefficient algorithmic complexity, a remote, unauthenticated attacker can send specially crafted input to cause excessive resource consumption. This can lead to application unresponsiveness, resulting in a Denial of Service DoS...

CVE-2026-94655

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by sending specially crafted input to an application that uses the Lua bindings. Due to a lack of proper resource allocation limits and inefficient processing, handling these requests consumes excessive system...

CVE-2026-94656

A flaw was found in the Apache Thrift Ruby bindings. The software does not properly restrict or throttle system resource allocation during request processing. A remote attacker could exploit this vulnerability by sending crafted requests that cause excessive resource consumption, resulting in a...

CVE-2026-94653

A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this issue to cause a Denial of Service DoS by sending specially crafted input. Due to inefficient algorithmic processing, handling these requests consumes disproportionate computing resources, causing the application...

CVE-2026-94645

A flaw was found in the Apache Thrift Node.js bindings. A remote attacker can cause a Denial of Service DoS by sending specially crafted input specifying improper quantity values. Because the application fails to properly validate the requested quantity before allocating resources, processing the...

CVE-2026-96990

A flaw was found in Apache Thrift's Erlang bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending requests that trigger excessive resource allocation without proper limits or throttling. This issue can lead to resource exhaustion, resulting in a Denial of Service...