ROOT-APP-MAVEN-CVE-2026-43869 CVE-2026-43869 in org.apache.thrift:libthrift - Patched by Root

Root has patched CVE-2026-43869 in the org.apache.thrift:libthrift package for Root:Maven. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-41602 CVE-2026-41602 in github.com/apache/thrift - Patched by Root

Root has patched CVE-2026-41602 in the github.com/apache/thrift package for Root:Go. Multiple fixed versions available...

RHSA-2026:51358 Red Hat Security Advisory: RHEL AI 3.6 RPM runtime CVE fix - thrift

Bulletin has no description...

CLSA-2026-1783645394 TuxCare security update for org.apache.thrift:libthrift (1 CVE)

TuxCare rebuilt org.apache.thrift:libthrift to address 1 CVE. Fixed in 0.14.1-tuxcare.1...

RHSA-2026:49716 Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - thrift

Bulletin has no description...

CVE-2026-58389 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58389 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

OPENSUSE-SU-2026:11432-1 libthrift-0_24_0-0.24.0-1.1 on GA media

These are all security issues fixed in the libthrift-0240-0.24.0-1.1 package on the GA media of openSUSE Tumbleweed...

UBUNTU-CVE-2026-58023

Out-of-bounds Read vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

UBUNTU-CVE-2026-55969

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the TZlibTransport...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the TZlibTransport read paths in the C++, Java, Python, and Go bindings. An...

Allocation of Resources Without Limits or Throttling

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the TCompactProtocol...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ZLIB read path in thrift.transport.THeaderTransport.THeaderTransport. An attacker can force excessive memo...

OPENSUSE-SU-2026:20816-1 Security update for alloy

This update for alloy fixes the following issues - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service bsc1262955. - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer...

UBUNTU-CVE-2026-43868

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue...

Improper Validation of Certificate with Host Mismatch

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to insufficient verificatio...

UBUNTU-CVE-2025-48431

Mismatched Memory Management Routines vulnerability in Apache Thrift cglib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an cglib-based Thrift server...

Integer Overflow or Wraparound

Overview github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library. Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the TFramedTransport function on 32-bit architectures. An attacker...

PT-2026-35685

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.23.0 Description Improper validation of certificates with host mismatch occurs in the Java TSSLTransportFactory hostname verification process. Recommendations Upgrade to version 0.23.0...

libthrift: potential DoS when processing untrusted payloads

A flaw was found in libthrift. Applications using Thrift would not show an error upon receiving messages declaring containers of sizes larger than the payload. This results in malicious RPC clients with the ability to send short messages which would result in a large memory allocation, potentiall...