CVE-2026-94636 Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-94636 Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-90440

Apache Thrift's D language implementation is vulnerable in the TNonblockingServer component due to improper handling of exceptional conditions and improper resource shutdown. This flaw allows an exception escaping a libevent callback to trigger an uncaught exception during server operations. A re...

EUVD-2026-91400

Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-90440

Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to improper exception handling in the TNonblockingServer. An attacker can disrupt server availability by sending specially crafted requests that trigger unhandled exceptions, resulting in the termination of the...

CVE-2026-104432

Zebra versions prior to 6.3.0 are vulnerable to an improper exceptional condition check within the ChainSync::obtain_tips function. This flaw causes the software to discard valid one-hash FindBlocks responses, resulting in the node falsely reporting a close-to-tip status. When peers return only t...

EUVD-2026-91443

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtaintips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK...

CVE-2026-104432 Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtaintips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK...

CVE-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via improper evaluation of the certificate's Common Name during TLS certificate validation when subject alternative name entries do not match the target host. An attacker can intercept or tamper with...

CVE-2026-85087 Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91417

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85087 Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85087

The Apache Thrift python bindings are vulnerable to improper certificate validation and the return of wrong status codes in versions before 0.25.0 . A specific underlying cause involves the host-name check silently becoming a no-op when using Python ≥3.12 . This vulnerability can lead to security...

CVE-2026-85087

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85086 Apache Thrift: Perl TLS client disables certificate verification by default

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85086

A vulnerability exists in the Apache Thrift perl bindings due to insecure default settings and improper certificate validation . These flaws cause client connections to fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could explo...

EUVD-2026-91416

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105395 CVE-2026-94645 affecting package thrift 0.24.0-1

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...