agentprime: apache-software-foundation-apache-thrift

agentprime: apache-software-foundation-apache-thriftEvery new CVE for apache-software-foundation-apache-thrift.https://agentprime.io/CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by defaulthttps://agentprime.io/advisories/CVE-2026-120135/https://agentprime.io/advisories/CVE-2026-120135/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 20:33:00 GMTCVECVE-2026-66054: Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSizehttps://agentprime.io/advisories/CVE-2026-66054/https://agentprime.io/advisories/CVE-2026-66054/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:58:05 GMTCVECVE-2026-61374: Apache Thrift: Java TSaslTransport post-auth data-frame missing size limithttps://agentprime.io/advisories/CVE-2026-61374/https://agentprime.io/advisories/CVE-2026-61374/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:53:00 GMTCVECVE-2026-63772: Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform counthttps://agentprime.io/advisories/CVE-2026-63772/https://agentprime.io/advisories/CVE-2026-63772/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:52:07 GMTCVECVE-2026-66055: Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)https://agentprime.io/advisories/CVE-2026-66055/https://agentprime.io/advisories/CVE-2026-66055/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:49:40 GMTCVECVE-2026-66081: Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messageshttps://agentprime.io/advisories/CVE-2026-66081/https://agentprime.io/advisories/CVE-2026-66081/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:33:13 GMTCVECVE-2026-66331: Apache Thrift: Buffered transport reads are not accounted against MaxMessageSizehttps://agentprime.io/advisories/CVE-2026-66331/https://agentprime.io/advisories/CVE-2026-66331/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:32:46 GMTCVECVE-2026-66837: Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string lengthhttps://agentprime.io/advisories/CVE-2026-66837/https://agentprime.io/advisories/CVE-2026-66837/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:29:09 GMTCVECVE-2026-66858: Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)https://agentprime.io/advisories/CVE-2026-66858/https://agentprime.io/advisories/CVE-2026-66858/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:27:31 GMTCVECVE-2026-66859: Apache Thrift: c_glib multiplexed processor crashes on a message it cannot routehttps://agentprime.io/advisories/CVE-2026-66859/https://agentprime.io/advisories/CVE-2026-66859/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:23:48 GMTCVECVE-2026-83632: Apache Thrift: C++ THttpTransport grows its line buffer without boundhttps://agentprime.io/advisories/CVE-2026-83632/https://agentprime.io/advisories/CVE-2026-83632/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:22:23 GMTCVEcriticalCVE-2026-83663: Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)https://agentprime.io/advisories/CVE-2026-83663/https://agentprime.io/advisories/CVE-2026-83663/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:18:16 GMTCVECVE-2026-83745: Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)https://agentprime.io/advisories/CVE-2026-83745/https://agentprime.io/advisories/CVE-2026-83745/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:16:15 GMTCVECVE-2026-85476: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0https://agentprime.io/advisories/CVE-2026-85476/https://agentprime.io/advisories/CVE-2026-85476/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:12:45 GMTCVECVE-2026-96289: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guardhttps://agentprime.io/advisories/CVE-2026-96289/https://agentprime.io/advisories/CVE-2026-96289/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:07:02 GMTCVECVE-2026-96287: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)https://agentprime.io/advisories/CVE-2026-96287/https://agentprime.io/advisories/CVE-2026-96287/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:05:59 GMTCVECVE-2026-96286: Apache Thrift: Perl servers end `serve()` when serving one connection failshttps://agentprime.io/advisories/CVE-2026-96286/https://agentprime.io/advisories/CVE-2026-96286/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:04:28 GMTCVECVE-2026-96277: Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exceptionhttps://agentprime.io/advisories/CVE-2026-96277/https://agentprime.io/advisories/CVE-2026-96277/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:03:23 GMTCVECVE-2026-94658: Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)https://agentprime.io/advisories/CVE-2026-94658/https://agentprime.io/advisories/CVE-2026-94658/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:02:21 GMTCVECVE-2026-94657: Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size boundhttps://agentprime.io/advisories/CVE-2026-94657/https://agentprime.io/advisories/CVE-2026-94657/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:01:36 GMTCVECVE-2026-94656: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size boundhttps://agentprime.io/advisories/CVE-2026-94656/https://agentprime.io/advisories/CVE-2026-94656/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 12:00:51 GMTCVECVE-2026-94655: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratichttps://agentprime.io/advisories/CVE-2026-94655/https://agentprime.io/advisories/CVE-2026-94655/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:59:18 GMTCVECVE-2026-94654: Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary framehttps://agentprime.io/advisories/CVE-2026-94654/https://agentprime.io/advisories/CVE-2026-94654/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:58:49 GMTCVECVE-2026-94653: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)https://agentprime.io/advisories/CVE-2026-94653/https://agentprime.io/advisories/CVE-2026-94653/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:56:35 GMTCVECVE-2026-94652: Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling backhttps://agentprime.io/advisories/CVE-2026-94652/https://agentprime.io/advisories/CVE-2026-94652/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:54:41 GMTCVECVE-2026-94648: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size boundhttps://agentprime.io/advisories/CVE-2026-94648/https://agentprime.io/advisories/CVE-2026-94648/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:52:48 GMTCVECVE-2026-94646: Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)https://agentprime.io/advisories/CVE-2026-94646/https://agentprime.io/advisories/CVE-2026-94646/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:52:21 GMTCVECVE-2026-94638: Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`https://agentprime.io/advisories/CVE-2026-94638/https://agentprime.io/advisories/CVE-2026-94638/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:49:43 GMTCVECVE-2026-94637: Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB framehttps://agentprime.io/advisories/CVE-2026-94637/https://agentprime.io/advisories/CVE-2026-94637/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:49:02 GMTCVECVE-2026-94636: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used uphttps://agentprime.io/advisories/CVE-2026-94636/https://agentprime.io/advisories/CVE-2026-94636/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:47:54 GMTCVECVE-2026-92834: Apache Thrift: C++ WebSocket server transport does not read a full request lengthhttps://agentprime.io/advisories/CVE-2026-92834/https://agentprime.io/advisories/CVE-2026-92834/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:45:25 GMTCVECVE-2026-90440: Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny servicehttps://agentprime.io/advisories/CVE-2026-90440/https://agentprime.io/advisories/CVE-2026-90440/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:44:11 GMTCVECVE-2026-87117: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spechttps://agentprime.io/advisories/CVE-2026-87117/https://agentprime.io/advisories/CVE-2026-87117/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:43:11 GMTCVECVE-2026-86537: Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny servicehttps://agentprime.io/advisories/CVE-2026-86537/https://agentprime.io/advisories/CVE-2026-86537/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:40:51 GMTCVECVE-2026-86536: Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScripthttps://agentprime.io/advisories/CVE-2026-86536/https://agentprime.io/advisories/CVE-2026-86536/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:40:06 GMTCVECVE-2026-86535: Apache Thrift: A JSON member name can stall the Node server's event loop indefinitelyhttps://agentprime.io/advisories/CVE-2026-86535/https://agentprime.io/advisories/CVE-2026-86535/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:38:16 GMTCVECVE-2026-85088: Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not matchhttps://agentprime.io/advisories/CVE-2026-85088/https://agentprime.io/advisories/CVE-2026-85088/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:37:14 GMTCVECVE-2026-85087: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-ophttps://agentprime.io/advisories/CVE-2026-85087/https://agentprime.io/advisories/CVE-2026-85087/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:35:44 GMTCVECVE-2026-85086: Apache Thrift: Perl TLS client disables certificate verification by defaulthttps://agentprime.io/advisories/CVE-2026-85086/https://agentprime.io/advisories/CVE-2026-85086/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:34:00 GMTCVECVE-2026-82459: Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit processhttps://agentprime.io/advisories/CVE-2026-82459/https://agentprime.io/advisories/CVE-2026-82459/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:32:30 GMTCVECVE-2026-82458: Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes…https://agentprime.io/advisories/CVE-2026-82458/https://agentprime.io/advisories/CVE-2026-82458/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:30:51 GMTCVECVE-2026-96288: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)https://agentprime.io/advisories/CVE-2026-96288/https://agentprime.io/advisories/CVE-2026-96288/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:18:37 GMTCVECVE-2026-96292: Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)https://agentprime.io/advisories/CVE-2026-96292/https://agentprime.io/advisories/CVE-2026-96292/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:11:33 GMTCVECVE-2026-96294: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connectionhttps://agentprime.io/advisories/CVE-2026-96294/https://agentprime.io/advisories/CVE-2026-96294/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:09:56 GMTCVECVE-2026-61373: Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocationhttps://agentprime.io/advisories/CVE-2026-61373/https://agentprime.io/advisories/CVE-2026-61373/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:07:29 GMTCVECVE-2026-96990: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size boundhttps://agentprime.io/advisories/CVE-2026-96990/https://agentprime.io/advisories/CVE-2026-96990/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:00:27 GMTCVECVE-2026-94642: Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exceptionhttps://agentprime.io/advisories/CVE-2026-94642/https://agentprime.io/advisories/CVE-2026-94642/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 10:57:14 GMTCVECVE-2026-94644: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size boundhttps://agentprime.io/advisories/CVE-2026-94644/https://agentprime.io/advisories/CVE-2026-94644/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 10:53:37 GMTCVECVE-2026-94645: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop boundhttps://agentprime.io/advisories/CVE-2026-94645/https://agentprime.io/advisories/CVE-2026-94645/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 10:51:40 GMTCVECVE-2026-94650: Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)https://agentprime.io/advisories/CVE-2026-94650/https://agentprime.io/advisories/CVE-2026-94650/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 10:49:37 GMTCVE