CVE-2026-66055

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91627

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Allocation of Resources Without Limits or Throttling

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the readJSONString and readJSONNumericChars methods of TJSONProtocol, which accumulate a...

CVE-2026-66081 Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66081

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66081 Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66081

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66081

A flaw exists in the Apache Thrift c_glib bindings (versions before 0.25.0 ) where the read_message_begin function leaves output parameters unset for non-versioned messages. This results in an Access of Uninitialized Pointer vulnerability. A remote, unauthenticated attacker can exploit this by se...

EUVD-2026-91588

Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66331

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66331 Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66331

The Apache Thrift library, specifically versions before 0.25.0 , is vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770). The issue exists within the Delphi bindings buffered transport, where buffered transport reads are not properly accounted against the ...

CVE-2026-66331 Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91587

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Out-of-bounds Write

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Out-of-bounds Write due to an integer overflow in the PHP bindings that results in a stack-based buffer overflow when processing specially crafted data. An attacker can cause the service to...

CVE-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66837

A flaw exists in the Apache Thrift PHP bindings (versions before 0.25.0 ) where an integer overflow allows a wire-controlled string length to improperly size a stack buffer. This leads to a stack-based buffer overflow when processing specially crafted data. A remote, unauthenticated attacker can ...