PT-2026-104327

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

PT-2026-104333

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift C++ bindings contain an issue where the C++ THeaderTransport does not enforce the configured maxFrameSize. This leads to the allocation of resources without limits or throttling...

PT-2026-104331

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Java bindings contain an issue where resources are allocated without limits or throttling, which can lead to resource exhaustion. Recommendations Upgrade to version 0.25.0...

PT-2026-104321

Access of Uninitialized Pointer vulnerability in Apache Thrift c glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104332

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An allocation of resources without limits or throttling issue exists in the Apache Thrift Go bindings. This can lead to an unauthenticated single-packet crash of Go Thrift servers through the...

PT-2026-104297

Improper handling of highly compressed data data amplification vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104290

Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-104296

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-104288

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104304

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-104305

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104306

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104217

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104291

Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue...

PT-2026-104293

NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104298

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94650: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104322

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An issue exists in the Apache Thrift Delphi bindings buffered transport where resources are allocated without limits or throttling. This can lead to excessive resource consumption...

PT-2026-104315

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Inefficient Algorithmic Complexity in the Perl bindings of Apache Thrift. Recommendations Upgrade to version 0.25.0...

PT-2026-104181

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Improper handling of length parameter inconsistency and allocation of resources without limits or throttling in Apache Thrift Lua bindings. Specifically, the TBinaryProtocol:readMessageBegin...