thrift: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements

A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this vulnerability by sending specially crafted input containing improperly validated quantity values. This causes the application to perform excessive iterations and consume memory or CPU resources without limits,...

thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound

A flaw was found in Apache Thrift's Erlang bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending requests that trigger excessive resource allocation without proper limits or throttling. This issue can lead to resource exhaustion, resulting in a Denial of Service...

thrift: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

A flaw was found in Apache Thrift's Erlang bindings. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted input that triggers uncontrolled recursion and unrestricted resource allocation. As a result, the application can exhaust available system...

thrift: Apache Thrift: Perl servers end `serve()` when serving one connection fails

A flaw was found in Apache Thrift. An uncaught exception within the Perl bindings allows a remote attacker to cause a Denial of Service DoS. By sending specially crafted input, an attacker can trigger an unhandled error condition, causing the application to crash unexpectedly...

thrift: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound

A flaw was found in the Apache Thrift Ruby bindings. The software does not properly restrict or throttle system resource allocation during request processing. A remote attacker could exploit this vulnerability by sending crafted requests that cause excessive resource consumption, resulting in a...

thrift: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)

A flaw was found in the Apache Thrift Perl bindings. A remote attacker could exploit this vulnerability by sending specially crafted input to an application using the affected bindings. This triggers inefficient data processing, leading to excessive resource consumption and a Denial of Service Do...

thrift: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

A flaw was found in Apache Thrift's Node.js bindings. A remote attacker can exploit improper exception handling by triggering an uncaught exception. This failure causes the application process to crash, leading to a Denial of Service DoS...

thrift: thrift: Denial of Service via inefficient algorithmic complexity in Lua bindings

A flaw was found in Apache Thrift Lua bindings. Due to inefficient algorithmic complexity, a remote, unauthenticated attacker can send specially crafted input to cause excessive resource consumption. This can lead to application unresponsiveness, resulting in a Denial of Service DoS...

thrift: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by sending specially crafted input to an application that uses the Lua bindings. Due to a lack of proper resource allocation limits and inefficient processing, handling these requests consumes excessive system...

thrift: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

A flaw was found in Apache Thrift. The Dart bindings fail to properly restrict or throttle resource allocation when processing incoming requests. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, causing excessive resource consumption that lea...

thrift: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0

A flaw was found in Apache Thrift. A remote attacker could cause a Denial of Service DoS by sending specially crafted input to an application using the C GLib bindings. Processing this malformed data triggers an infinite loop, consuming system resources and causing the application to become...

CLEANSTART-2026-EK15836 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

CLEANSTART-2026-KQ03860 Security fix for GHSA-r7wm-3cxj-wff9 applied in: apache-nifi 2.5.0-r1

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MD90103 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-GQ65848 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-OF13352 jackson-databind binds a JSON string to a javax

Security vulnerability affects the apache-nifi package. jackson-databind binds a JSON string to a javax...

CLEANSTART-2026-GO38541 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

Security vulnerability affects the apache-nifi package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

CLEANSTART-2026-SJ80754 Apache NiFi 0

Security vulnerability affects the apache-nifi package. Apache NiFi 0...

CLEANSTART-2026-DD70166 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-WH10300 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...