Vulnerability · Published Feb 12, 2021 · Assigned by apache
CVE-2020-13949
High 7.5
In plain English
A high-severity security flaw in Apache Thrift. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.8% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)6.8%top 6.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | thrift | 0.14.0-r0 | ALPINE-CVE-2020-13949 |
| Alpine:v3.21 | thrift | 0.14.0-r0 | ALPINE-CVE-2020-13949 |
| Alpine:v3.22 | thrift | 0.14.0-r0 | ALPINE-CVE-2020-13949 |
| Alpine:v3.23 | thrift | 0.14.0-r0 | ALPINE-CVE-2020-13949 |
| Alpine:v3.24 | thrift | 0.14.0-r0 | ALPINE-CVE-2020-13949 |
| Debian:12 | thrift | 0.16.0-3 | DEBIAN-CVE-2020-13949 |
| Debian:13 | thrift | 0.16.0-3 | DEBIAN-CVE-2020-13949 |
| Debian:14 | thrift | 0.16.0-3 | DEBIAN-CVE-2020-13949 |
| Maven | org.apache.thrift:libthrift | 0.14.0 | GHSA-g2fg-mr77-6vrm |
| Ubuntu:22.04:LTS | thrift | no fix listed | UBUNTU-CVE-2020-13949 |
| Ubuntu:24.04:LTS | thrift | no fix listed | UBUNTU-CVE-2020-13949 |
| Ubuntu:25.10 | thrift | no fix listed | UBUNTU-CVE-2020-13949 |
| Ubuntu:26.04:LTS | thrift | no fix listed | UBUNTU-CVE-2020-13949 |
| Ubuntu:26.10 | thrift | no fix listed | UBUNTU-CVE-2020-13949 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Thrift | Apache Thrift 0.9.3 to 0.13.0 |
References
- https://lists.apache.org/thread.html/r43dc2b2e928e9d845b07ac075634cb759d91bb852421dc282f87a74a%40%3Cdev.thrift.apache.org%3E x_refsource_MISC
- [hbase-issues] 20210215 [GitHub] [hbase] Apache-HBase commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210215 [GitHub] [hbase] pankaj72981 opened a new pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210215 [jira] [Work started] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210215 [GitHub] [hbase] pankaj72981 commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210215 [GitHub] [hbase] pankaj72981 edited a comment on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210215 [jira] [Commented] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210215 [GitHub] [hbase] apurtell commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210215 [GitHub] [hbase] apurtell edited a comment on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210216 [jira] [Commented] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [thrift-user] 20210217 Apache Thrift 0.14.0 Release not on Maven central mailing-list, x_refsource_MLIST
- [thrift-user] 20210224 Re: [SECURITY] CVE-2020-13949 Announcement mailing-list, x_refsource_MLIST
- [hbase-issues] 20210301 [GitHub] [hbase] Apache-HBase commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210302 [GitHub] [hbase] Apache-HBase commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210302 [jira] [Commented] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210302 [jira] [Updated] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210302 [GitHub] [hbase] Apache9 commented on a change in pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210302 [GitHub] [hbase] pankaj72981 commented on a change in pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210303 [GitHub] [hbase] Apache-HBase commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210308 [jira] [Commented] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210309 [GitHub] [hbase] pankaj72981 commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210310 [jira] [Commented] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210310 [GitHub] [hbase] Apache-HBase commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210311 [GitHub] [hbase] Apache-HBase commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210311 [GitHub] [hbase] pankaj72981 opened a new pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210311 [GitHub] [hbase] pankaj72981 closed pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210311 [GitHub] [hbase] pankaj72981 commented on pull request #2958: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210311 [GitHub] [hbase] Apache-HBase commented on pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210312 [GitHub] [hbase] pankaj72981 commented on pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210312 [GitHub] [hbase] Apache-HBase commented on pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [thrift-user] 20210312 Thrift 0.13 micro for CVE-2020-13949? mailing-list, x_refsource_MLIST
- [thrift-user] 20210312 RE: Thrift 0.13 micro for CVE-2020-13949? mailing-list, x_refsource_MLIST
- [hbase-issues] 20210315 [GitHub] [hbase] saintstack commented on pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210315 [GitHub] [hbase] Apache-HBase commented on pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210316 [GitHub] [hbase] pankaj72981 commented on pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210316 [jira] [Commented] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [hbase-issues] 20210316 [GitHub] [hbase] pankaj72981 merged pull request #3043: HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST
- [thrift-notifications] 20210317 [GitHub] [thrift] cyril867 commented on pull request #2208: THRIFT-5237 Implement MAX_MESSAGE_SIZE and consolidate limits into a TConfiguration class (c_glib) mailing-list, x_refsource_MLIST
- [thrift-notifications] 20210317 [GitHub] [thrift] cyril867 edited a comment on pull request #2208: THRIFT-5237 Implement MAX_MESSAGE_SIZE and consolidate limits into a TConfiguration class (c_glib) mailing-list, x_refsource_MLIST
- [hbase-issues] 20210317 [jira] [Commented] (HBASE-25568) Upgrade Thrift jar to fix CVE-2020-13949 mailing-list, x_refsource_MLIST