CVE-2026-66054

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66054

The Apache Thrift C++ bindings are vulnerable to a Denial of Service (DoS) attack due to a flaw in how the software handles highly compressed data. Specifically, the C++ THeaderTransport component fails to enforce the configured maxFrameSize , allowing a remote, unauthenticated attacker to send s...

CVE-2026-66054 Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91630

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91629

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-61374 Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-61374 Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-61374

The Apache Thrift Java bindings are vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) issue. Specifically, the Java TSaslTransport component fails to enforce a size limit on post-auth data-frames. This vulnerability affects versions before 0.25.0 . Impacting availabi...

CVE-2026-61374

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-63772 Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-63772 Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91628

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-63772

The Apache Thrift go bindings are vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770). This issue affects versions before 0.25.0 and can lead to an unauthenticated single-packet crash of Go Thrift servers via the THeader transform count . The high-severit...

CVE-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66055

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91627

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66055

The Apache Thrift framework (versions before 0.25.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw. Specifically, the TJSONProtocol component accepts a single JSON string or number that exceeds the configured size limit across multiple language bindings,...

CVE-2026-66081 Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91588

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...