CVE-2026-96277
CVE-2026-96277 · Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVSS 8.7 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache thrift
- Versions
- ≥ 0, < 0.25.0: Affected (semver)
Update to 0.25.0
thrift Debian:12
- Versions
- 0.17.0-2
- 0.17.0-3
- 0.17.0-4
- 0.18.1-1
- 0.18.1-2
- 0.19.0-1
- 0.19.0-2
- 0.19.0-2.1
- 0.19.0-2.1~exp1
- 0.19.0-3
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Debian:13
- Versions
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Debian:14
- Versions
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:20.04:LTS
- Versions
- 0.11.0.0-2
- 0.11.0.0-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:22.04:LTS
- Versions
- 0.11.0.0-3
- 0.14.0-2
- 0.14.0-2build1
- 0.14.0-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:24.04:LTS
- Versions
- 0.16.0-2
- 0.16.0-2build1
- 0.16.0-2build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published