Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

32 records in Thrift · all components

TI-2016-04675 CVE-2016-5397 · GHSA-r4m4-pmvw-m6j5

Command injection in Apache Thrift

Priority MEDIUM 48

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.06873 Published 2018-02-12 Partial fix · 0.10.0 CWE-77
TI-2026-40371 CVE-2026-55969 · GHSA-x8jh-qfcv-fp29

Integer overflow in Apache Thrift

Priority MEDIUM 46

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0103 Published 2026-07-27 Partial fix · 0.24.0 CWE-190
TI-2019-00181 CVE-2019-0205 · GHSA-rj7p-rfgp-852x

Infinite loop in Apache Thrift

Priority MEDIUM 45

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09156 Published 2019-10-28 Partial fix · 0.13.0 CWE-835
TI-2026-30157 CVE-2026-41636 · GHSA-r67j-r569-jrwp

Apache Thrift: Node.js skip() recursion

Priority MEDIUM 44

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-04-28 Partial fix · 0.23.0 CWE-674
TI-2018-01223 CVE-2018-1320 · GHSA-wjxj-f8rg-99wx

Improper certificate validation in Apache Thrift

Priority MEDIUM 44

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08188 Published 2019-01-07 Partial fix · 0.9.3-1, 0.12.0 CWE-295
TI-2026-30145 CVE-2026-41604 · GHSA-r4rx-ffxv-23vw

Apache Thrift: Swift Range crash in skip()

Priority MEDIUM 43

Out-of-bounds Read vulnerability in Apache Thrift.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00918 Published 2026-04-28 Partial fix · 0.23.0 CWE-125
TI-2020-10925 CVE-2020-13949 · GHSA-g2fg-mr77-6vrm

Uncontrolled resource consumption in Apache Thrift

Priority MEDIUM 43

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06861 Published 2021-02-12 Partial fix · 0.14.0 CWE-400
TI-2019-00183 CVE-2019-0210 · GHSA-jq7p-26h5-w78r

Out-of-bounds read in Apache Thrift

Priority MEDIUM 42

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06531 Published 2019-10-28 Partial fix · 0.13.0 CWE-125
TI-2026-30144 CVE-2026-41602 · GHSA-wf45-q9ch-q8gh

Apache Thrift: Go TFramedTransport uint32 overflow

Priority MEDIUM 41

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01163 Published 2026-04-28 Partial fix · 0.23.0 CWE-190
TI-2026-31934 CVE-2026-43870 · GHSA-526f-jxpj-jmg2

Apache Thrift: Node.js web_server.js multi-vulnerability

Priority LOW 38

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resourc…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00379 Published 2026-05-05 Partial fix · 0.23.0 CWE-113
Load more
Open these records in search →