11209 matches found
ECHO-A0D5-8274-4E9B
Bulletin has no description...
ECHO-E487-258C-3BBB
Bulletin has no description...
ECHO-E752-E91D-4F33
Bulletin has no description...
ECHO-36C4-65B5-D264 Java-only: TSaslTransport has no size limit on post-auth data frames. Built with --without-java; no Java binary package is produced.
Bulletin has no description...
ECHO-CB5B-CE35-C664 Java-only: the TSaslNonblockingServer allocates a pre-auth SASL frame of any size the peer declares. Built with --without-java; no Java binary package is produced.
Bulletin has no description...
ECHO-F016-0B10-74AB
Bulletin has no description...
ECHO-C182-7D24-F2CE
Bulletin has no description...
ECHO-9A41-FD88-BA7D Java-only: the remainder of CVE-2026-61373 in TSaslNonblockingServer. Built with --without-java; no Java binary package is produced.
Bulletin has no description...
ECHO-3073-2AB6-F3CE Lua-only: readMessageBegin skips checkStringSize on the pre-versioned name. Built with --without-lua; no Lua binary package is produced.
Bulletin has no description...
ECHO-CF23-B450-BCBC
Bulletin has no description...
ECHO-E462-125F-31D5 Node.js and D only: the WebSocket frame decoders allocate the declared payload length before the bytes arrive. Built with --without-nodejs, and no D compiler is in Build-Depends, so neither binding is built or packaged. The C++ WebSocket server is a separate code path, covered by CVE-2026-92834.
Bulletin has no description...
ECHO-5B20-0629-38E0 Erlang-only: thrift_json_protocol reads a whole message with no size bound. Built with --without-erlang; no Erlang binary package is produced.
Bulletin has no description...
ECHO-C545-33EF-E2CB
Bulletin has no description...
ECHO-1837-F347-D4EF Lua-only: THttpTransport:_parseHeaders uses a backtracking pattern. Built with --without-lua; no Lua binary package is produced.
Bulletin has no description...
ECHO-D047-A420-5293
Bulletin has no description...
ECHO-74E4-BC56-1C57
Bulletin has no description...
ECHO-905A-722E-5437
Bulletin has no description...
ECHO-1EA4-3623-C77A
Bulletin has no description...
ECHO-D8CD-76F2-90CE
Bulletin has no description...
ECHO-2B06-582D-E34B
Bulletin has no description...
ECHO-EE1E-0D1F-F204
Bulletin has no description...
ECHO-AFB2-4C2A-858D
Bulletin has no description...
ECHO-4B79-8FCC-A519
Bulletin has no description...
ECHO-3142-9EE0-CC4E Java-only: TSaslNonblockingServer orphans a connection on a pre-auth parse error. Built with --without-java; no Java binary package is produced.
Bulletin has no description...
ECHO-3E90-5931-8CC8 Java ME only: TJsonProtocol has no string size bound. lib/javame has no autotools hook, and no binary package ships it.
Bulletin has no description...
ECHO-673E-1D33-9D40
Bulletin has no description...
ECHO-8D5E-E094-CE34 Lua-only: the TJsonProtocol string and number readers are unbounded and quadratic. Built with --without-lua; no Lua binary package is produced.
Bulletin has no description...
ECHO-5526-4FCA-655E
Bulletin has no description...
ECHO-6408-669E-310F
Bulletin has no description...
ECHO-2105-178D-17AB Node.js-only: TJSONProtocol uses a container size declared by the peer as an unbounded loop bound. Built with --without-nodejs; no Node binary package is produced.
Bulletin has no description...
ECHO-75F9-4777-A649 Node.js-only: server.js ends the process on any per-connection error. Built with --without-nodejs; no Node binary package is produced.
Bulletin has no description...
ECHO-7AAB-30F5-28D5
Bulletin has no description...
ECHO-EEC7-309E-8D44
Bulletin has no description...
ECHO-1BB9-37B4-45B7 Lua-only: TFramedTransport and THttpTransport re-slice the buffer on every read. Built with --without-lua; no Lua binary package is produced.
Bulletin has no description...
ECHO-2746-22D8-BC1F Dart-only: TJsonProtocol has no string size bound. No Dart SDK is in Build-Depends, and no binary package ships lib/dart.
Bulletin has no description...
ECHO-EB0D-1BF9-F192
Bulletin has no description...
ECHO-2C86-81C6-C3B3 Dart and Java ME only: TProtocolUtil.skip follows unbounded nesting. Neither binding has a build here (no Dart SDK in Build-Depends, and Java ME has no autotools hook), and no binary package ships them.
Bulletin has no description...
ECHO-E672-55E9-2902
Bulletin has no description...
ECHO-7068-A82E-7936 Dart-only: TBinaryProtocol.readMessageBegin allocates from the pre-versioned name length. No Dart SDK is in Build-Depends, and no binary package ships lib/dart.
Bulletin has no description...
ECHO-D354-77ED-2D99 D-only: an exception escaping a libevent callback stops the D TNonblockingServer. lib/d is not built or packaged; see CVE-2026-86537.
Bulletin has no description...
ECHO-0533-4861-9A91 Node.js-only: a JSON member name can stall the event loop in the nodejs TJSONProtocol. Built with --without-nodejs; no Node binary package is produced.
Bulletin has no description...
ECHO-B697-02DF-DD87 Erlang-only: thrift_protocol:read/2 in lib/erl followed struct nesting without a depth limit. The upstream fix (e94803e2) is entirely in the Erlang runtime; generated Erlang code only carries struct_info type descriptors, so thrift-compiler's Erlang generator is unchanged. Built with --without-erlang; no Erlang binary package is produced.
Bulletin has no description...
ECHO-1F3D-84C1-CA4A
Bulletin has no description...
ECHO-218A-790F-6EA4
Bulletin has no description...
ECHO-B4BA-B8EF-AD47
Bulletin has no description...
ECHO-F168-B048-19C7 Node.js-only: web_server.js has no error listener on an upgraded WebSocket connection. Built with --without-nodejs; no Node binary package is produced.
Bulletin has no description...
ECHO-60B5-CEF2-33ED
Bulletin has no description...
ECHO-A236-CB53-7FC3
Bulletin has no description...