CVE-2026-82459: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound, Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-82458: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-61373: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85494: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

CVE-2026-85493: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104215

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Erlang bindings contain an issue involving uncontrolled recursion and the allocation of resources without limits or throttling. Recommendations Upgrade to version 0.25.0...

CVE-2026-94639: Improper Handling of Exceptional Conditions

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94635: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94634: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94636: Improper Handling of Highly Compressed Data (Data Amplification)

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-104210

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An allocation of resources without limits or throttling issue exists in the Java TSaslNonblockingServer. This occurs when the server fails to properly restrict the consumption of system...

PT-2026-104288

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift python bindings contain an issue involving improper certificate validation and the return of incorrect status codes. Recommendations Upgrade to version 0.25.0...

PT-2026-104327

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncontrolled recursion issue exists in the Go bindings. Both Go transports attempt to satisfy a read from a buffered frame; if the frame contains no payload bytes, the system reads the next...

CVE-2026-94652: Missing Release of Memory after Effective Lifetime

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104291

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description All JavaScript bindings in Apache Thrift are subject to prototype pollution, a condition where an attacker can manipulate the prototype of an object to inject properties or modify existing one...

PT-2026-104306

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description A memory leak occurs in the Apache Thrift C++ bindings due to a missing release of memory after its effective lifetime. Recommendations Update to version 0.25.0...

CVE-2026-86536: Improperly Controlled Modification of Object Prototype Attributes

Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue...

PT-2026-104297

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Go bindings contain an issue involving the improper handling of highly compressed data, which can lead to data amplification. Data amplification occurs when a small amount of inp...

PT-2026-104204

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift PHP bindings contain an issue involving improper validation of specified quantities in input, allocation of resources without limits or throttling, and excessive iteration. This...

PT-2026-104212

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift PHP bindings contain an issue where resources are allocated without limits or throttling, which can lead to resource exhaustion. Recommendations Update to version 0.25.0...