Advisories · Technology
Apache Software Foundation Apache Thrift.
Every CVE that names Apache Software Foundation Apache Thrift among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 6.9 Medium
Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-409
- CVSS 7.1 High
Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 6.9 Medium
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 8.7 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
Apache Thrift: C++ THttpTransport grows its line buffer without bound
- Apache Software Foundation Apache Thrift
- Memory corruption
- Denial of service
- CVSS 8.7 High
Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 8.2 High
Apache Thrift: c_glib `read_all` spins when the underlying read returns 0
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Perl servers end `serve()` when serving one connection fails
- Apache Software Foundation Apache Thrift
- CWE-248
- CVSS 8.7 High
Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception
- Apache Software Foundation Apache Thrift
- CWE-248
- CWE-755
- CVSS 8.7 High
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 6.3 Medium
Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
- Apache Software Foundation Apache Thrift
- Prototype pollution
- CWE-248
- CVSS 6.3 Medium
Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame
- Apache Software Foundation Apache Thrift
- CWE-409
- CVSS 8.2 High
Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up
- Apache Software Foundation Apache Thrift
- CWE-409
- CWE-628
- CVSS 6.3 Medium
Apache Thrift: C++ WebSocket server transport does not read a full request length
- Apache Software Foundation Apache Thrift
- Memory corruption
- CWE-393
- CVSS 8.2 High
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-248
- CVSS 8.7 High
Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 8.7 High
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
- Apache Software Foundation Apache Thrift
- Memory corruption
- Denial of service
- CVSS 6.3 Medium
Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript
- Apache Software Foundation Apache Thrift
- Prototype pollution
- CVSS 8.7 High
Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
- Apache Software Foundation Apache Thrift
- Denial of service
- Prototype pollution
- CVSS 6.9 Medium
Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match
- Apache Software Foundation Apache Thrift
- Weak cryptography or TLS
- CVSS 6.9 Medium
Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
- Apache Software Foundation Apache Thrift
- Weak cryptography or TLS
- CWE-393
- CVSS 6.9 Medium
Apache Thrift: Perl TLS client disables certificate verification by default
- Apache Software Foundation Apache Thrift
- Weak cryptography or TLS
- CWE-1188
- CVSS 8.2 High
Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 8.7 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes…
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection
- Apache Software Foundation Apache Thrift
- CWE-248
- CWE-755
- CVSS 8.7 High
Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
- Apache Software Foundation Apache Thrift
- CWE-248
- CVSS 8.2 High
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-1284
- CVSS 8.2 High
Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.2 High
Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-755
- CVSS 6.3 Medium
Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end
- Apache Software Foundation Apache Thrift
- Memory corruption
- CWE-393
- CVSS 8.7 High
Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-248
- CVSS 8.7 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 9.2 CriticalCritical · CVSS 9+
Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 8.7 High
Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-1284
- CVSS 8.7 High
Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id
- Apache Software Foundation Apache Thrift
- Memory corruption
- Denial of service
- CVSS 8.7 High
Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 8.7 High
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 8.2 High
Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-1188