# Apache Software Foundation Apache Thrift. Every CVE that names Apache Software Foundation Apache Thrift among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default](https://agentprime.io/advisories/CVE-2026-120135.md) `CVE-2026-120135` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Denial of service - [Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize](https://agentprime.io/advisories/CVE-2026-66054.md) `CVE-2026-66054` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-409 - [Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit](https://agentprime.io/advisories/CVE-2026-61374.md) `CVE-2026-61374` · CVE record: Apache Software Foundation Apache Thrift · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count](https://agentprime.io/advisories/CVE-2026-63772.md) `CVE-2026-63772` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)](https://agentprime.io/advisories/CVE-2026-66055.md) `CVE-2026-66055` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages](https://agentprime.io/advisories/CVE-2026-66081.md) `CVE-2026-66081` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption - [Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize](https://agentprime.io/advisories/CVE-2026-66331.md) `CVE-2026-66331` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length](https://agentprime.io/advisories/CVE-2026-66837.md) `CVE-2026-66837` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption - [Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)](https://agentprime.io/advisories/CVE-2026-66858.md) `CVE-2026-66858` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route](https://agentprime.io/advisories/CVE-2026-66859.md) `CVE-2026-66859` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption - [Apache Thrift: C++ THttpTransport grows its line buffer without bound](https://agentprime.io/advisories/CVE-2026-83632.md) `CVE-2026-83632` · CVE record: Apache Software Foundation Apache Thrift · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption, Denial of service - [Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)](https://agentprime.io/advisories/CVE-2026-83663.md) `CVE-2026-83663` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)](https://agentprime.io/advisories/CVE-2026-83745.md) `CVE-2026-83745` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-130 - [Apache Thrift: c_glib \`read_all\` spins when the underlying read returns 0](https://agentprime.io/advisories/CVE-2026-85476.md) `CVE-2026-85476` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: php \`--gen php:inlined\` struct readers (and \`TProtocol::skipBinary\`) have no recursion-depth guard](https://agentprime.io/advisories/CVE-2026-96289.md) `CVE-2026-96289` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Perl \`FramedTransport\` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)](https://agentprime.io/advisories/CVE-2026-96287.md) `CVE-2026-96287` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Perl servers end \`serve()\` when serving one connection fails](https://agentprime.io/advisories/CVE-2026-96286.md) `CVE-2026-96286` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248 - [Apache Thrift: Ruby \`SimpleServer\` ends \`serve()\` on any non-Transport/Protocol exception](https://agentprime.io/advisories/CVE-2026-96277.md) `CVE-2026-96277` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248, CWE-755 - [Apache Thrift: Lua \`TFramedTransport\`/\`THttpTransport\` re-slice the buffer on every read (quadratic)](https://agentprime.io/advisories/CVE-2026-94658.md) `CVE-2026-94658` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: javame \`TJsonProtocol\`/\`TJSONProtocol\` has no string size bound](https://agentprime.io/advisories/CVE-2026-94657.md) `CVE-2026-94657` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: rb \`TJsonProtocol\`/\`TJSONProtocol\` has no string size bound](https://agentprime.io/advisories/CVE-2026-94656.md) `CVE-2026-94656` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Lua \`TJsonProtocol\` string/number readers have no size bound and are quadratic](https://agentprime.io/advisories/CVE-2026-94655.md) `CVE-2026-94655` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Python \`TNonblockingServer\` busy-loops and stops selecting all fds after an 8192-byte-boundary frame](https://agentprime.io/advisories/CVE-2026-94654.md) `CVE-2026-94654` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)](https://agentprime.io/advisories/CVE-2026-94653.md) `CVE-2026-94653` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: C++ \`TEvhttpServer\` leaks its \`RequestContext\` when the processor throws before calling back](https://agentprime.io/advisories/CVE-2026-94652.md) `CVE-2026-94652` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: dart \`TJsonProtocol\`/\`TJSONProtocol\` has no string size bound](https://agentprime.io/advisories/CVE-2026-94648.md) `CVE-2026-94648` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Node.js \`server.js\` ends the process on any per-connection error (+ two triggers)](https://agentprime.io/advisories/CVE-2026-94646.md) `CVE-2026-94646` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Prototype pollution, CWE-248, CWE-1284 - [Apache Thrift: PHP \`thrift_protocol\` C extension ignores the configured \`maxStringSize\`](https://agentprime.io/advisories/CVE-2026-94638.md) `CVE-2026-94638` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Go \`THeaderTransport\` does not bound the inflated size of a ZLIB frame](https://agentprime.io/advisories/CVE-2026-94637.md) `CVE-2026-94637` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-409 - [Apache Thrift: Python \`TZlibTransport\` stops enforcing its decompressed-size limit once the limit is exactly used up](https://agentprime.io/advisories/CVE-2026-94636.md) `CVE-2026-94636` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-409, CWE-628, CWE-1284 - [Apache Thrift: C++ WebSocket server transport does not read a full request length](https://agentprime.io/advisories/CVE-2026-92834.md) `CVE-2026-92834` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption, CWE-393 - [Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service](https://agentprime.io/advisories/CVE-2026-90440.md) `CVE-2026-90440` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-248, CWE-755 - [Apache Thrift: PHP \`thrift_protocol\` accelerator dereferences a missing container-element spec](https://agentprime.io/advisories/CVE-2026-87117.md) `CVE-2026-87117` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption - [Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service](https://agentprime.io/advisories/CVE-2026-86537.md) `CVE-2026-86537` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption, Denial of service, CWE-248 - [Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript](https://agentprime.io/advisories/CVE-2026-86536.md) `CVE-2026-86536` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Prototype pollution - [Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely](https://agentprime.io/advisories/CVE-2026-86535.md) `CVE-2026-86535` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, Prototype pollution - [Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match](https://agentprime.io/advisories/CVE-2026-85088.md) `CVE-2026-85088` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS - [Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op](https://agentprime.io/advisories/CVE-2026-85087.md) `CVE-2026-85087` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS, CWE-393 - [Apache Thrift: Perl TLS client disables certificate verification by default](https://agentprime.io/advisories/CVE-2026-85086.md) `CVE-2026-85086` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS, CWE-1188 - [Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process](https://agentprime.io/advisories/CVE-2026-82459.md) `CVE-2026-82459` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption - [Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes…](https://agentprime.io/advisories/CVE-2026-82458.md) `CVE-2026-82458` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)](https://agentprime.io/advisories/CVE-2026-96288.md) `CVE-2026-96288` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Lua \`THttpTransport:\_parseHeaders\` matches each header line with a backtracking pattern (quadratic)](https://agentprime.io/advisories/CVE-2026-96292.md) `CVE-2026-96292` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: nodejs web server: no \`error\` listener on an upgraded WebSocket connection](https://agentprime.io/advisories/CVE-2026-96294.md) `CVE-2026-96294` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248, CWE-755 - [Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation](https://agentprime.io/advisories/CVE-2026-61373.md) `CVE-2026-61373` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound](https://agentprime.io/advisories/CVE-2026-96990.md) `CVE-2026-96990` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: PHP \`TSimpleServer\` exits the whole process on any non-transport exception](https://agentprime.io/advisories/CVE-2026-94642.md) `CVE-2026-94642` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248 - [Apache Thrift: PHP \`TJSONProtocol\` string/number readers have no size bound](https://agentprime.io/advisories/CVE-2026-94644.md) `CVE-2026-94644` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Node.js \`TJSONProtocol\` uses a peer-declared container size as an unbounded loop bound](https://agentprime.io/advisories/CVE-2026-94645.md) `CVE-2026-94645` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-1284 - [Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)](https://agentprime.io/advisories/CVE-2026-94650.md) `CVE-2026-94650` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Java \`TSaslNonblockingServer\` \`Computation.run\` orphans a connection on a pre-auth parse error](https://agentprime.io/advisories/CVE-2026-94651.md) `CVE-2026-94651` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-755 - [Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end](https://agentprime.io/advisories/CVE-2026-85483.md) `CVE-2026-85483` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption, CWE-393 - [Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)](https://agentprime.io/advisories/CVE-2026-85493.md) `CVE-2026-85493` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-248 - [Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…](https://agentprime.io/advisories/CVE-2026-85494.md) `CVE-2026-85494` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-130, CWE-248, CWE-1188 - [Apache Thrift: C++ \`THeaderTransport::transform()\` heap buffer overflow (write direction)](https://agentprime.io/advisories/CVE-2026-91135.md) `CVE-2026-91135` · CVE record: Apache Software Foundation Apache Thrift · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption - [Apache Thrift: PHP \`thrift_protocol\` accelerator: zero-byte container elements](https://agentprime.io/advisories/CVE-2026-91137.md) `CVE-2026-91137` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-1284 - [Apache Thrift: C++ \`THeaderTransport::writeVarint32()\` stack buffer overflow on a negative protocol id](https://agentprime.io/advisories/CVE-2026-93925.md) `CVE-2026-93925` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption, Denial of service, CWE-1335 - [Apache Thrift: C++ \`THeaderTransport::untransform()\` leaks the zlib stream on the error path](https://agentprime.io/advisories/CVE-2026-93926.md) `CVE-2026-93926` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Apache Thrift: Dart \`TBinaryProtocol.readMessageBegin\` allocates from the pre-versioned name length](https://agentprime.io/advisories/CVE-2026-94633.md) `CVE-2026-94633` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-130 - [Apache Thrift: Python \`TJSONProtocol\` has a string length limit that is off by default](https://agentprime.io/advisories/CVE-2026-94634.md) `CVE-2026-94634` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-1188 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .