Fixes 51 records
Priority MEDIUM 45
Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-1284
Priority MEDIUM 44
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-248
Priority MEDIUM 44
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-407
Priority MEDIUM 44
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-130
Priority MEDIUM 44
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0036 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-191
Priority MEDIUM 44
Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00359 · Published 2026-10-02 · Fixed in 0.25.0 CWE-1321
Priority MEDIUM 44
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-130
Priority MEDIUM 44
Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-770
Priority MEDIUM 44
Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00349 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-121
Priority MEDIUM 43
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-248
Priority MEDIUM 43
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.003 · Published 2026-10-02 · Fixed in 0.25.0 CWE-1284
Priority MEDIUM 43
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-130
Priority MEDIUM 43
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-401
Priority MEDIUM 43
Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00306 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-121
Priority MEDIUM 43
NULL pointer dereference vulnerability in Apache Thrift PHP bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-476
Priority MEDIUM 43
Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerabilit…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0031 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-1188
Priority MEDIUM 43
Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-248
Priority MEDIUM 43
NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00316 · Published 2026-10-02 · Fixed in 0.25.0 CWE-457
Priority MEDIUM 43
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00307 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-674
Priority MEDIUM 43
Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00316 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-824
Priority MEDIUM 42
Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-770
Priority MEDIUM 41
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00303 · Published 2026-10-02 · Fixed in 0.25.0 CWE-1284
Priority MEDIUM 41
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-770
Priority LOW 36
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00374 · Published 2026-10-02 · Fixed in 0.25.0 CWE-770
Priority LOW 36
Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-674
Priority LOW 36
Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-674
Priority LOW 36
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-407
Priority LOW 36
Uncaught exception vulnerability in Apache Thrift Perl bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-248
Priority LOW 36
Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-770
Priority LOW 36
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-407
Priority LOW 36
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00332 · Published 2026-10-02 · Fixed in 0.25.0 CWE-835
Priority LOW 36
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00332 · Published 2026-10-02 · Fixed in 0.25.0 CWE-835
Priority LOW 36
Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-191
Priority LOW 36
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-770
Priority LOW 36
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-409
Priority LOW 35
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-1333
Priority LOW 35
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-407
Priority LOW 35
Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00303 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-674
Priority LOW 35
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-770
Priority LOW 35
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00303 · Published 2026-10-02 · Fixed in 0.25.0 CWE-770
Priority LOW 35
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-1284
Priority LOW 35
Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-1188
Priority LOW 35
Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-248
Priority LOW 32
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0017 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-295
Priority LOW 32
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00176 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-1188
Priority LOW 31
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00153 · Published 2026-10-02 · Fixed in 0.25.0 CWE-295
Priority LOW 28
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-401
Priority LOW 28
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-770
Priority LOW 28
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00277 · Published 2026-10-02 · Fixed in 0.25.0 CWE-393
Priority LOW 28
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.003 · Published 2026-10-02 · Partial fix · 0.25.0 CWE-1321
Priority LOW 28
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00342 · Published 2026-10-02 · Fixed in 0.25.0 CWE-393
THREATIST.IORead the docs