Apache Software Foundation Apache Thrift vulnerabilities

CVE-2026-92834 [MEDIUM] CWE-393 CVE-2026-92834: Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSoc Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-61374 [HIGH] CWE-770 CVE-2026-61374: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-66331 [MEDIUM] CWE-770 CVE-2026-66331: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-85086 [MEDIUM] CWE-295 CVE-2026-85086: Improper certificate validation, Initialization of a resource with an insecure default vulnerability Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94638 [MEDIUM] CWE-770 CVE-2026-94638: Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94652 [MEDIUM] CWE-401 CVE-2026-94652: Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. T Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-85087 [MEDIUM] CWE-295 CVE-2026-85087: Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python b Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-66053 [MEDIUM] CWE-297 CVE-2026-66053: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603

CVE-2026-41606 [MEDIUM] CWE-674 CVE-2026-41606: Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.2 Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.