1668 matches found
CVE-2026-94653
The Apache Thrift PHP bindings (versions prior to 0.25.0 ) are vulnerable to an Inefficient Algorithmic Complexity (CWE-407) issue. The root cause is that framed, memory, and HTTP transports re-slice the buffer on every read operation, leading to quadratic complexity. This can result in a high im...
CVE-2026-94653 Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
EUVD-2026-91566
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94653 Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94653
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-82459
A flaw was found in Apache Thrift. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted network traffic to an affected application. Due to an integer underflow in the 32-bit C++ THeaderTransport component, processing this malformed data triggers an...
CVE-2026-82458
A flaw was found in Apache Thrift. Multiple language bindings fail to properly restrict memory allocation when processing input containing excessive size values. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, consuming available memory and...
CVE-2026-94652 Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
EUVD-2026-91565
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94652 Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94652
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94652
The Apache Thrift c++ bindings contain a memory leak vulnerability (CWE-401) affecting versions before 0.25.0 . Specifically, the C++ TEvhttpServer component fails to release its RequestContext memory when a processor throws an exception before a callback is executed. This vulnerability can lead ...
CVE-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
EUVD-2026-91564
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94648
The Apache Thrift dart bindings are vulnerable to an allocation of resources without limits or throttling (CWE-770) because the TJsonProtocol/TJSONProtocol components lack a string size bound . This issue affects versions before 0.25.0 . To remediate, users are recommended to upgrade to version 0...
CVE-2026-94646 Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
EUVD-2026-91563
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
CVE-2026-94646 Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
CVE-2026-94646
A vulnerability exists in Apache Thrift nodejs bindings prior to version 0.25.0 due to improper input validation and prototype pollution . This condition allows an attacker to modify base JavaScript object properties, causing the application to fail when processing incoming data. A remote attacke...