CVE-2019-3558

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

CVE-2019-3553

C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Faceboo...

Malicious code in evenote-thrift (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3021 Malicious code in evenote-thrift (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Linux Distros Unpatched Vulnerability : CVE-2020-13949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial...

GHSA-77PM-W3HX-F8MJ Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

MAL-2024-10313 Malicious code in evernote-thrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0cafc1fbe5d3aca2d0d736873649060e6c9dce551db713b3d91723a78f9a2f22 The OpenSSF Package Analysis project identified 'evernote-thrift' @ 1.4.8 npm as malicious. It is considered malicious because: - The package...

Malicious code in evernote-thrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0cafc1fbe5d3aca2d0d736873649060e6c9dce551db713b3d91723a78f9a2f22 The OpenSSF Package Analysis project identified 'evernote-thrift' @ 1.4.8 npm as malicious. It is considered malicious because: - The package...

AZL-49728 CVE-2024-45773 affecting package thrift for versions less than 0.15.0-5

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00...

CVE-2024-45863

A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00...

CVE-2024-45773

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00...

CVE-2024-45863

CVE-2024-45863 involves a null-dereference in Facebook Thrift when parsing requests that specify invalid protocols, affecting versions v2024.09.09.00 through v2024.09.23.00. The issue can cause the application to crash and may lead to other undesirable effects as described in connected advisories...

CVE-2024-45863

A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00...

CVE-2024-45863

A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00...

CVE-2024-45773

A use-after-free vulnerability in upgradeToRocket requests affects Facebook Thrift versions prior to v2024.09.09.00. The issue can cause application crashes and potentially enable code execution or other undesirable effects. Remediation: upgrade to Facebook Thrift v2024.09.09.00 or newer (as indi...

CVE-2024-45773

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00...

CVE-2024-45773

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00...

Facebook Thrift 安全漏洞

Facebook Thrift is a fork of Apache Thrift, a serialization and RPC framework for service communication from Facebook, USA. A security vulnerability exists in versions prior to Facebook Thrift v2024.09.09.00, which stems from reuse after release and could cause an application crash...

Facebook Thrift 安全漏洞

Facebook Thrift is a fork of Apache Thrift, a serialization and RPC framework for service communication from Facebook, USA. A security vulnerability exists in Facebook Thrift versions v2024.09.09.00 through v2024.09.23.00, which stems from a null pointer reference related to resolving a request...

In Apache Thrift all versions up to and including 0.12.0 a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0 depending on the installed version it affects only certain language bindings.

...