EUVD-2026-91443

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtaintips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK...

CVE-2026-104432

Zebra versions prior to 6.3.0 are vulnerable to an improper exceptional condition check within the ChainSync::obtain_tips function. This flaw causes the software to discard valid one-hash FindBlocks responses, resulting in the node falsely reporting a close-to-tip status. When peers return only t...

CVE-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the...

EUVD-2026-91417

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85087

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85087 Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85087

The Apache Thrift python bindings are vulnerable to improper certificate validation and the return of wrong status codes in versions before 0.25.0 . A specific underlying cause involves the host-name check silently becoming a no-op when using Python ≥3.12 . This vulnerability can lead to security...

CVE-2026-85087 Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85086

A vulnerability exists in the Apache Thrift perl bindings due to insecure default settings and improper certificate validation . These flaws cause client connections to fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could explo...

EUVD-2026-91416

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85086 Apache Thrift: Perl TLS client disables certificate verification by default

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105395 CVE-2026-94645 affecting package thrift 0.24.0-1

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94645

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96294

The Apache Thrift NodeJS bindings are susceptible to an Uncaught exception and Improper Handling of Exceptional Conditions vulnerability. This issue specifically impacts versions of Apache Thrift released before 0.25.0 . While some documentation suggests the root cause relates to a missing error ...

CVE-2026-96294 Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91411

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96294

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96294 Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94645

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94645

The Apache Thrift nodejs bindings are vulnerable to an improper validation of specified quantity in input and an allocation of resources without limits or throttling vulnerability. Specifically, the TJSONProtocol component uses a peer-declared container size as an unbounded loop bound. This issue...