PatchFirst · Latest vulnerabilities

thrift vulnerabilities · Page 4

Vulnerabilities published for thrift in the last 30 days: 61. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 91

CVE-2026-94635
High · CVSS 8.7EPSS 0.34%No fix published
Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
thrift Operating systems
Published October 2, 2026Updated October 2, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-66053
Medium · CVSS 5.9EPSS 0.29%No fix published
Apache Thrift: Python TSSLSocket Hostname Matcher Import
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-58662
High · CVSS 8.7EPSS 1.08%No fix published
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-58389
High · CVSS 8.7EPSS 1.03%No fix published
Apache Thrift: Rust binary protocol non-strict path missing string size limit
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-58023
Medium · CVSS 6.9EPSS 1.02%No fix published
Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-55971
Critical · CVSS 9.3EPSS 0.98%No fix published
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-55970
Medium · CVSS 6.9EPSS 0.78%No fix published
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-55969
High · CVSS 8.7EPSS 1.03%No fix published
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-55968
High · CVSS 8.7EPSS 1.03%No fix published
Apache Thrift: Node.js quadratic-time DoS in server receive transports
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-49158
High · CVSS 7.5EPSS 1.03%No fix published
Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-48586
High · CVSS 8.7EPSS 1.03%No fix published
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-48145
High · CVSS 8.2EPSS 0.42%No fix published
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-48144
Critical · CVSS 9.1EPSS 0.4%No fix published
Apache Thrift: c_glib TLS Client Missing Hostname Verification
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-45112
Medium · CVSS 6.9EPSS 1.03%No fix published
Apache Thrift: Unbounded Read Leading to Denial of Service
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-43871
High · CVSS 8.7EPSS 1.03%No fix published
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 27, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-41608
High · CVSS 7.5EPSS 1.03%No fix published
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
thrift Operating systems
Published July 27, 2026Updated July 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-43868
Medium · CVSS 5.3EPSS 0.71%No fix published
Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
thrift Operating systems
Published May 5, 2026Updated July 22, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-43870
High · CVSS 7.3EPSS 0.38%No fix published
Apache Thrift: Node.js web_server.js multi-vulnerability
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
thrift Operating systems
Published May 5, 2026Updated May 6, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-43869
High · CVSS 7.3EPSS 0.63%No fix published
Apache Thrift: TSSLTransportFactory.java hostname verification
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
thrift Operating systems
Published May 5, 2026Updated September 9, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-41636
High · CVSS 8.7EPSS 0.45%No fix published
Apache Thrift: Node.js skip() recursion
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
thrift Operating systems
Published April 28, 2026Updated April 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

thrift vulnerabilities · Page 4

Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name

Apache Thrift: Python TSSLSocket Hostname Matcher Import

Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

Apache Thrift: Rust binary protocol non-strict path missing string size limit

Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

Apache Thrift: Node.js quadratic-time DoS in server receive transports

Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass

Apache Thrift: c_glib TLS Client Missing Hostname Verification

Apache Thrift: Unbounded Read Leading to Denial of Service

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Apache Thrift: Node.js web_server.js multi-vulnerability

Apache Thrift: TSSLTransportFactory.java hostname verification

Apache Thrift: Node.js skip() recursion

Check your server