CVE-2026-94656
CVE-2026-94656 · Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVSS 8.2 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache thrift
- Versions
- ≥ 0, < 0.25.0: Affected (semver)
Update to 0.25.0
thrift Debian:12
- Versions
- 0.17.0-2
- 0.17.0-3
- 0.17.0-4
- 0.18.1-1
- 0.18.1-2
- 0.19.0-1
- 0.19.0-2
- 0.19.0-2.1
- 0.19.0-2.1~exp1
- 0.19.0-3
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Debian:13
- Versions
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Debian:14
- Versions
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:20.04:LTS
- Versions
- 0.11.0.0-2
- 0.11.0.0-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:22.04:LTS
- Versions
- 0.11.0.0-3
- 0.14.0-2
- 0.14.0-2build1
- 0.14.0-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:24.04:LTS
- Versions
- 0.16.0-2
- 0.16.0-2build1
- 0.16.0-2build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published