Apache Software Foundation Apache Thrift vulnerabilities

CVE-2026-55971 [CRITICAL] CWE-122 CVE-2026-55971: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache T Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2016-5397 [HIGH] CWE-77 CVE-2016-5397: The Apache Thrift Go client library exposed the potential during code generation for command injecti The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

CVE-2026-91135 [CRITICAL] CWE-122 CVE-2026-91135: Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an applicati Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compress

CVE-2026-58662 [CRITICAL] CWE-125 CVE-2026-58662: Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrif Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2026-48144 [CRITICAL] CWE-297 CVE-2026-48144: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2026-58023 [CRITICAL] CWE-125 CVE-2026-58023: Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2026-83632 [CRITICAL] CWE-122 CVE-2026-83632: Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buf Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-66837 [HIGH] CWE-121 CVE-2026-66837: Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindi Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-66858 [HIGH] CWE-674 CVE-2026-66858: The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion li The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml

CVE-2026-93925 [HIGH] CWE-121 CVE-2026-93925: Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ T Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-66081 [HIGH] CWE-824 CVE-2026-66081: Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affect Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94646 [HIGH] CWE-248 CVE-2026-94646: Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modifi Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94642 [HIGH] CWE-248 CVE-2026-94642: Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-86537 [HIGH] CWE-191 CVE-2026-86537: Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-86535 [HIGH] CWE-835 CVE-2026-86535: Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96277 [HIGH] CWE-248 CVE-2026-96277: Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-82458 [HIGH] CWE-770 CVE-2026-82458: Memory allocation with excessive size value, Allocation of resources without limits or throttling vu Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-83745 [HIGH] CWE-130 CVE-2026-83745: Memory allocation with excessive size value, Improper handling of length parameter inconsistency vul Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte

CVE-2026-94635 [HIGH] CWE-130 CVE-2026-94635: Allocation of resources without limits or throttling, Improper handling of length parameter inconsis Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94658 [HIGH] CWE-407 CVE-2026-94658: Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affect Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.