Apache Software Foundation Apache Thrift vulnerabilities

CVE-2026-94645 [HIGH] CWE-770 CVE-2026-94645: Improper validation of specified quantity in input, Allocation of resources without limits or thrott Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94653 [HIGH] CWE-407 CVE-2026-94653: Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affect Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-41605 [HIGH] CWE-190 CVE-2026-41605: Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: be Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVE-2026-96990 [HIGH] CWE-770 CVE-2026-96990: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94655 [HIGH] CWE-407 CVE-2026-94655: Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerabili Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96286 [HIGH] CWE-248 CVE-2026-96286: Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94657 [HIGH] CWE-770 CVE-2026-94657: Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94656 [HIGH] CWE-770 CVE-2026-94656: Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96288 [HIGH] CWE-674 CVE-2026-96288: Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-85476 [HIGH] CWE-835 CVE-2026-85476: Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib binding Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94644 [HIGH] CWE-770 CVE-2026-94644: Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94634 [HIGH] CWE-770 CVE-2026-94634: Allocation of resources without limits or throttling, Initialization of a resource with an insecure Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-66055 [HIGH] CWE-770 CVE-2026-66055: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, n Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-96292 [HIGH] CWE-407 CVE-2026-96292: Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apach Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94648 [HIGH] CWE-770 CVE-2026-94648: Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94637 [HIGH] CWE-409 CVE-2026-94637: Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go b Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-55969 [HIGH] CWE-190 CVE-2026-55969: Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Ha Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2026-45112 [HIGH] CWE-770 CVE-2026-45112: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2026-41608 [HIGH] CWE-409 CVE-2026-41608: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Pyth Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2026-48586 [HIGH] CWE-409 CVE-2026-48586: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.