thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings

A flaw was found in Apache Thrift. A remote attacker could exploit improper resource allocation controls in the JavaME bindings to cause a Denial of Service DoS. By sending requests that trigger unbounded resource consumption, an attacker can exhaust system resources and make the service...

thrift: thrift: Denial of Service via uncaught exception in Ruby bindings

A flaw was found in the Apache Thrift Ruby bindings. This vulnerability allows a remote attacker to cause a Denial of Service DoS due to improper handling of exceptional conditions. By triggering an uncaught exception, an attacker can crash the service and disrupt availability...

thrift: Apache Thrift: Perl servers end `serve()` when serving one connection fails

A flaw was found in Apache Thrift. An uncaught exception within the Perl bindings allows a remote attacker to cause a Denial of Service DoS. By sending specially crafted input, an attacker can trigger an unhandled error condition, causing the application to crash unexpectedly...

thrift: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard

A flaw was found in Apache Thrift's PHP bindings. A remote attacker could cause a denial of service DoS by sending specially crafted input that triggers uncontrolled recursion. This excessive recursion can exhaust system resources or stack space, leading to an application crash...

thrift: thrift: Denial of Service via inefficient regular expression evaluation in Lua bindings

A flaw was found in Apache Thrift's Lua bindings. A remote attacker could exploit this vulnerability by sending specially crafted input that triggers inefficient regular expression processing. This can cause excessive resource consumption, resulting in a Denial of Service DoS on the affected...

thrift: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

A flaw was found in Apache Thrift's Node.js bindings. A remote attacker can exploit improper exception handling by triggering an uncaught exception. This failure causes the application process to crash, leading to a Denial of Service DoS...

thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings

A flaw was found in the Apache Thrift Lua bindings. A remote attacker could exploit this vulnerability by sending requests containing inconsistent length parameters, triggering excessive resource allocation without proper limits. This issue can exhaust available system memory or processing...

thrift: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

A flaw was found in Apache Thrift's Erlang bindings. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted input that triggers uncontrolled recursion and unrestricted resource allocation. As a result, the application can exhaust available system...

CLEANSTART-2026-EK15836 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

CLEANSTART-2026-KQ03860 Security fix for GHSA-r7wm-3cxj-wff9 applied in: apache-nifi 2.5.0-r1

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OF13352 jackson-databind binds a JSON string to a javax

Security vulnerability affects the apache-nifi package. jackson-databind binds a JSON string to a javax...

CLEANSTART-2026-GQ65848 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-MD90103 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-SJ80754 Apache NiFi 0

Security vulnerability affects the apache-nifi package. Apache NiFi 0...

CLEANSTART-2026-DD70166 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-WH10300 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-XF54528 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-GO38541 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

Security vulnerability affects the apache-nifi package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

CLEANSTART-2026-FR49757 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

Security vulnerability affects the apache-nifi package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

CLEANSTART-2026-ML93784 SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X

Security vulnerability affects the apache-nifi package. SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X...