What’s Vulnerable › Products
Apache Software Foundation Apache Thrift vulnerabilities
93 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 86 published in the last 12 months.
Check whether your Apache Software Foundation Apache Thrift version is affected
Latest Apache Software Foundation Apache Thrift vulnerabilities
- CVE-2026-96289 — Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard (CVSS 8.2)
- CVE-2026-96287 — Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) (CVSS 8.2)
- CVE-2026-96286 — Apache Thrift: Perl servers end `serve()` when serving one connection fails (CVSS 8.2)
- CVE-2026-96277 — Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception (CVSS 8.7)
- CVE-2026-94658 — Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic) (CVSS 8.7)
- CVE-2026-94657 — Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound (CVSS 8.2)
- CVE-2026-94656 — Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound (CVSS 8.2)
- CVE-2026-94655 — Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic (CVSS 8.2)
- CVE-2026-94654 — Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame (CVSS 8.2)
- CVE-2026-85476 — Apache Thrift: c_glib `read_all` spins when the underlying read returns 0 (CVSS 8.2)
- CVE-2026-83745 — Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D) (CVSS 8.7)
- CVE-2026-83663 — Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go) (CVSS 8.7)
- CVE-2026-83632 — Apache Thrift: C++ THttpTransport grows its line buffer without bound (CVSS 9.2)
- CVE-2026-66859 — Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route (CVSS 8.7)
- CVE-2026-66858 — Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml) (CVSS 8.7)
- CVE-2026-66837 — Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length (CVSS 8.7)
- CVE-2026-66331 — Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize (CVSS 6.9)
- CVE-2026-66081 — Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages (CVSS 8.7)
- CVE-2026-66055 — Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language) (CVSS 8.2)
- CVE-2026-66054 — Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize (CVSS 6.9)
- CVE-2026-63772 — Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count (CVSS 8.7)
- CVE-2026-61374 — Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit (CVSS 7.1)
- CVE-2026-96294 — Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection (CVSS 8.7)
- CVE-2026-96292 — Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic) (CVSS 8.2)
- CVE-2026-96288 — Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) (CVSS 8.2)