Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

...

Inefficient Algorithmic Complexity

Apache Thrift is vulnerable to Inefficient Algorithmic Complexity. The vulnerability is due to Allocation of Resources Without Limits or Throttling, where an attacker can exploit the issue by causing the application to consume excessive resources, and this can lead to a denial-of-service conditio...

Denial Of Service (DoS)

Apache Thrift Ruby bindings are vulnerable to Denial Of Service. The vulnerability is due to improper handling of highly compressed data, where crafted compressed input can cause excessive data amplification and resource consumption, leading to application unavailability...

CLSA-2026-1775003187 TuxCare security update for org.apache.thrift (1 CVE)

TuxCare rebuilt 2 org.apache.thrift packages to address 1 CVE. Fixed in 0.9.1-tuxcare.4...

CLSA-2026-1774916752 TuxCare security update for org.apache.thrift (1 CVE)

TuxCare rebuilt 2 org.apache.thrift packages to address 1 CVE. Fixed in 0.9.3-tuxcare.4...

CLSA-2026-1773965922 TuxCare security update for org.apache.thrift (5 CVEs)

TuxCare rebuilt 2 org.apache.thrift packages to address 5 CVEs. Fixed in 0.9.1-tuxcare.3...

CLSA-2026-1772756024 TuxCare security update for org.apache.thrift (4 CVEs)

TuxCare rebuilt 2 org.apache.thrift packages to address 4 CVEs. Fixed in 0.9.3-tuxcare.2...

CLSA-2025-1765843686 TuxCare security update for org.apache.thrift (2 CVEs)

TuxCare rebuilt 2 org.apache.thrift packages to address 2 CVEs. Fixed in 0.9.1-tuxcare.1...

CVE-2026-43871

A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...

thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation

A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's...

thrift: Apache Thrift: Information disclosure and denial of service due to out-of-bounds read

A flaw was found in Apache Thrift cglib bindings. This out-of-bounds read vulnerability allows an attacker to potentially access sensitive information or cause a denial of service. The vulnerability occurs when the software attempts to read data beyond the allocated memory buffer...

thrift: Apache Thrift Node.js bindings: Denial of Service due to inefficient algorithmic complexity and resource allocation

A flaw was found in Apache Thrift Node.js bindings. This vulnerability, stemming from inefficient algorithmic complexity and the allocation of resources without proper limits or throttling, allows a remote attacker to cause a Denial of Service DoS. By exploiting this, an attacker can consume...

thrift: Apache Thrift Python bindings: Denial of Service via data amplification

A flaw was found in Apache Thrift Python bindings. This vulnerability involves the improper handling of highly compressed data, leading to a data amplification issue. An attacker could exploit this by providing specially crafted compressed input, which may cause the application to consume excessi...

thrift: Apache Thrift: Denial of Service via infinite loop

A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...

thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation

A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or thrott...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

thrift: Apache Thrift C++ bindings: Information disclosure due to buffer over-read vulnerability

A flaw was found in Apache Thrift C++ bindings. This buffer over-read vulnerability allows a remote attacker to read beyond the intended memory boundaries. This could lead to the disclosure of sensitive information or cause the application to become unavailable...

thrift: Apache Thrift Ruby bindings: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift Ruby bindings. This vulnerability, categorized as improper handling of highly compressed data, allows a remote attacker to cause a denial of service DoS through a data amplification attack. By sending specially crafted highly compressed data, an attacker can...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...