Apache Software Foundation Apache Thrift

• CVE-2026-94651 High 7.5 Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error 0.3%
• CVE-2026-85483 Medium 6.3 Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end 0.3%
• CVE-2026-85493 High 8.7 Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) 0.3%
• CVE-2026-85494 High 7.5 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language) 0.3%
• CVE-2026-91135 Critical 9.2 Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) 0.3%
• CVE-2026-91137 High 8.7 Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements 0.3%
• CVE-2026-93925 High 8.7 Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id 0.3%
• CVE-2026-93926 High 8.7 Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path 0.3%
• CVE-2026-94633 High 8.7 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length 0.3%
• CVE-2026-94634 High 8.2 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default 0.3%
• CVE-2026-94639 High 8.2 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) 0.3%
• CVE-2026-94635 High 8.7 Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name 0.3%
• CVE-2026-66053 Medium 5.9 Apache Thrift: Python TSSLSocket Hostname Matcher Import 0.3%
• CVE-2026-58662 High 8.7 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass 1.1%
• CVE-2026-58389 High 8.7 Apache Thrift: Rust binary protocol non-strict path missing string size limit 1.0%
• CVE-2026-58023 Medium 6.9 Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path 1.0%
• CVE-2026-55971 Critical 9.3 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() 1.0%
• CVE-2026-55970 Medium 6.9 Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() 0.8%
• CVE-2026-55969 High 8.7 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() 1.0%
• CVE-2026-55968 High 8.7 Apache Thrift: Node.js quadratic-time DoS in server receive transports 1.0%
• CVE-2026-49158 High 7.5 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb 1.0%
• CVE-2026-48586 High 8.7 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit 1.0%
• CVE-2026-48145 High 8.2 Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass 0.4%
• CVE-2026-48144 Critical 9.1 Apache Thrift: c_glib TLS Client Missing Hostname Verification 0.4%
• CVE-2026-45112 Medium 6.9 Apache Thrift: Unbounded Read Leading to Denial of Service 1.0%
• CVE-2026-43871 High 8.7 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit 1.0%
• CVE-2026-41608 High 7.5 Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport 1.0%
• CVE-2026-43868 Medium 5.3 Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern 0.7%
• CVE-2026-43870 High 7.3 Apache Thrift: Node.js web_server.js multi-vulnerability 0.4%
• CVE-2026-43869 High 7.3 Apache Thrift: TSSLTransportFactory.java hostname verification 0.6%
• CVE-2026-41636 High 8.7 Apache Thrift: Node.js skip() recursion 0.5%
• CVE-2026-41607 Medium 6.5 Apache Thrift: C++ JSON OOB read 0.9%
• CVE-2026-41606 Medium 5.3 Apache Thrift: c_glib dispatch stack overflow 1.1%
• CVE-2026-41605 High 7.3 Apache Thrift: Swift Compact Protocol integer overflow 0.9%
• CVE-2026-41604 High 8.2 Apache Thrift: Swift Range crash in skip() 0.9%
• CVE-2026-41602 High 7.5 Apache Thrift: Go TFramedTransport uint32 overflow 1.2%
• CVE-2025-48431 High 7.5 Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. 1.0%