CVE-2026-92834

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-92834

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-92834

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Improper Handling of Length Parameter Inconsistency

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via the WebSocket transport. An attacker can exhaust...

CVE-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

Improper Handling of Length Parameter Inconsistency

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via the WebSocket transport. An attack...

CVE-2026-83745

A vulnerability exists in Apache Thrift before version 0.25.0 affecting the Node.js and D lang bindings. The issue stems from WebSocket server transports reading the payload length from the frame header and immediately allocating that memory without verifying if the bytes have actually arrived. T...

CVE-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

EUVD-2026-91580

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

CVE-2026-92834 Apache Thrift: C++ WebSocket server transport does not read a full request length

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91559

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-92834 Apache Thrift: C++ WebSocket server transport does not read a full request length

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-92834

The Apache Thrift C++ WebSocket server is vulnerable to a use of uninitialized resource and the return of a wrong status code . The root cause is that the C++ WebSocket server transport fails to read a full request length. This issue affects versions before 0.25.0 . To remediate this vulnerabilit...

CVE-2026-92834

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96294 Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91125

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

EUVD-2026-91124

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment...

CVE-2026-97363: Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access...

PT-2026-105474

High Package gomod github.com/siyuan-note/siyuan/kernel Affected versions 3.7.3 Patched versions none yet — leave blank until a fix is released Description Summary /ws/network/proxy is an admin-only WebSocket forward-proxy endpoint target URL and headers fully attacker-specifiable via query...

PT-2026-104301

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Improper handling of length parameter inconsistency in the Node.js and D language bindings allows for memory allocation with excessive size values. The WebSocket server transports in both...