58 matches found
CVE-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-86535 Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
EUVD-2026-91452
Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
CVE-2026-86535
Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
CVE-2026-86535 Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
CVE-2026-86535
A flaw in Apache Thrift (versions before 0.25.0 ) allows a remote attacker to exploit the NodeJS bindings when using TJSONProtocol . By submitting specially crafted messages, an attacker can trigger an infinite loop or cause prototype pollution (unintended modification of shared object attributes...
CVE-2026-94644 Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94644 Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94634 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default
Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
CVE-2026-94634 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default
Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
PT-2026-104290
Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift NodeJS bindings using TJSONProtocol contain an infinite loop caused by an unreachable exit condition and a prototype pollution issue, which occurs when object prototype attribute...
CVE-2026-86535: Loop with Unreachable Exit Condition
Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...
thrift: thrift: Denial of Service via TJSONProtocol in Node.js bindings
A flaw was found in Apache Thrift. A remote attacker can exploit this vulnerability by submitting specially crafted messages to applications using the Node.js bindings with TJSONProtocol. Successful exploitation can trigger an infinite loop or cause prototype pollution unintended modification of...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: thrift (UTSA-2026-032290)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032290 advisory. In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data. Tenable has...
EUVD-2021-1123
Malware in sbrugna...
