CVE-2026-66837: Stack-based Buffer Overflow

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-83663: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-83745: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

CVE-2026-94657: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104200

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D language bindings contain multiple issues, including improper handling of length parameter inconsistency, uncaught...

PT-2026-104289

Name of the Vulnerable Software and Affected Versions Apache Thrift C++ library versions 0.7.0 through 0.24.0 Apache Thrift D library versions 0.9.0 through 0.24.0 Description Improper validation of certificates with host mismatches occurs in the C++ and D libraries. The default access manager fo...

PT-2026-104294

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the thrift.server.nonblocking.TNonblockingServer involving an uncaught exception, improper handling of exceptional conditions, and improper resource shutdown. Recommendation...

PT-2026-104323

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Stack-based Buffer Overflow, Integer Overflow or Wraparound issue exists in the php bindings of Apache Thrift. Recommendations Upgrade to version 0.25.0...

PT-2026-104326

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift contains an issue involving the allocation of resources without limits or throttling, integer overflow or wraparound, and a heap-based buffer overflow. A heap-based buffer overfl...

PT-2026-104203

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description A heap-based buffer overflow exists in the C++ THeaderTransport component. When the ZLIB transform is enabled for sent frames, the transform function copies the compressed frame into the write...

PT-2026-104327

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncontrolled recursion issue exists in the Go bindings. Both Go transports attempt to satisfy a read from a buffered frame; if the frame contains no payload bytes, the system reads the next...

PT-2026-104333

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift C++ bindings contain an issue where the C++ THeaderTransport does not enforce the configured maxFrameSize. This leads to the allocation of resources without limits or throttling...

CVE-2026-66054: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-91135: Heap-based Buffer Overflow

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as...

CVE-2026-66331: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-82459: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound, Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-90440: Uncaught Exception

Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104321

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An access of uninitialized pointer issue exists within the c glib bindings of Apache Thrift. Recommendations Upgrade to version 0.25.0...

CVE-2026-83632: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...