Advisories · Technology
Apache Software Foundation Apache Thrift.
Every CVE that names Apache Software Foundation Apache Thrift among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-248
- CVSS 8.7 High
Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-130
- CVSS 8.7 High
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
- Apache Software Foundation Apache Thrift
- Memory corruption
- CWE-1284
- CVSS 8.7 High
Apache Thrift: Rust binary protocol non-strict path missing string size limit
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 6.9 Medium
Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 6.9 Medium
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
- Apache Software Foundation Apache Thrift
- CWE-126
- CVSS 8.7 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 8.7 High
Apache Thrift: Node.js quadratic-time DoS in server receive transports
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 7.5 High
Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
- Apache Software Foundation Apache Thrift
- CWE-409
- CVSS 8.7 High
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
- Apache Software Foundation Apache Thrift
- CWE-409
- CVSS 8.2 High
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
- Apache Software Foundation Apache Thrift
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Thrift: c_glib TLS Client Missing Hostname Verification
- Apache Software Foundation Apache Thrift
- Weak cryptography or TLS
- CVSS 6.9 Medium
Apache Thrift: Unbounded Read Leading to Denial of Service
- Apache Software Foundation Apache Thrift
- Denial of service
- CVSS 6.5 Medium
Apache Thrift: C++ JSON OOB read
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 5.3 Medium
Apache Thrift: c_glib dispatch stack overflow
- Apache Software Foundation Apache Thrift
- Denial of service
- CWE-606
- CVSS 7.3 High
Apache Thrift: Swift Compact Protocol integer overflow
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 8.2 High
Apache Thrift: Swift Range crash in skip()
- Apache Software Foundation Apache Thrift
- Memory corruption
- CVSS 7.5 High
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
- Apache Software Foundation Apache Thrift
- Memory corruption
- CWE-762