Out-of-bounds read in Apache Thrift
Priority MEDIUM 42CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 fixed, 13 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
Why it matters now
EPSS 0.06531 93rd percentileScored 2026-11-07
Fix Partial github.com/apache/thrift (Go): 0.13.0Red Hat: 15 advisoriesRed Hat: 13 fixed, 13 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Thrift | 0.9.3 to 0.12.0 | — | No fix listed | CNA |
| — | github.com/apache/thrift (Go) | 0.9.3 to before 0.13.0 | 0.13.0 | Patch available | GHSA-jq7p-26h5-w78r |
- Apache Thrift VendorApache Affected 0.9.3 to 0.12.0 Fixed in — No fix listed CNA
- github.com/apache/thrift (Go) Vendor— Affected 0.9.3 to before 0.13.0 Fixed in 0.13.0 Patch available GHSA-jq7p-26h5-w78r
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* | 0.9.3 – 0.12.0 | Vulnerable | Apache |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* | 7.2.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Oracle |
- cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions 0.9.3 – 0.12.0 Vulnerable ·Apache
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-jq7p-26h5-w78r github.com/apache/thrift (Go) Fixed in 0.13.0 Advisory →
Red Hat 15 advisories
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
- RHSA-2020:2511 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
- RHSA-2020:2512 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
Show 12 more Red Hat advisories
- RHSA-2020:2513 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
- RHSA-2020:2515 Released 2020-06-10 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2020:2333 Released 2020-05-28 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 19 security update
- EAP-CD 19 Tech Preview
- RHSA-2020:2321 Released 2020-05-26 · Red Hat rating ImportantRed Hat Data Grid 7.3.6 security update
- Red Hat Data Grid 7.3.6
- RHSA-2020:2067 Released 2020-05-18 · Red Hat rating ImportantRed Hat build of Thorntail 2.5.1 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:0962 Released 2020-03-24 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3 security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap, eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el8eap, eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el8eap +5
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap, eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el6eap, eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el6eap +5
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap, eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap, eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap +5
- RHSA-2020:0961 Released 2020-03-24 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3 security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2020:0951 Released 2020-03-23 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.7 security update
- Red Hat Single Sign-On 7.3
- RHSA-2020:0805 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el7eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el7eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el7eap +47
- RHSA-2020:0804 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el6eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el6eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el6eap +47
- RHSA-2020:0806 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el8eap, eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el8eap, eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el8eap +47
- RHSA-2020:0811 Released 2020-03-12 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.7 security update
- Red Hat JBoss EAP 7.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| EAP-CD 19 Tech Preview | Fixed | RHSA-2020:2333 |
| Red Hat Data Grid 7.3.6 | Fixed | RHSA-2020:2321 |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2020:0811 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:0804 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:0805 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:0806 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2020:0962, RHSA-2020:2513 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2020:0962, RHSA-2020:2511 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2020:0962, RHSA-2020:2512 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2020:0961 |
| Red Hat Single Sign-On 7.3 | Fixed | RHSA-2020:0951 |
| Text-Only RHOAR | Fixed | RHSA-2020:2067 |
Not affected: 6 products
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat OpenShift Application Runtimes
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0210
- 2026-10-03 Alias added: GHSA-jq7p-26h5-w78r
- 2026-11-06 Affected versions changed · Red Hat
References
Advisory 7
Other 13
- [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9248: Upgrade Thrift dependency in broker to solve CVE-2019-0210 and CVE-2019-0205
- [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9248: Upgrade Thrift dependency in broker to solve CVE-2019-0210 and CVE-2019-0205
- [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9248: Upgrade Thrift dependency in broker to solve CVE-2019-0210 and CVE-2019-0205
- [pulsar-commits] 20210607 [GitHub] [pulsar] lhotari commented on issue #9248: Upgrade Thrift dependency in broker to solve CVE-2019-0210, CVE-2019-0205 and CVE-2020-13949
- https://github.com/apache/thrift/commit/264a3f318ed3e9e51573f67f963c8509786bcec2
- https://github.com/apache/thrift
- https://github.com/apache/thrift/blob/master/CHANGES.md#0130
- https://lists.apache.org/thread.html/r2832722c31d78bef7526e2c701ba4b046736e4c851473194a247392f@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r36581cc7047f007dd6aadbdd34e18545ec2c1eb7ccdae6dd47a877a9@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r55609613abab203a1f2c1f3de050b63ae8f5c4a024df0d848d6915ff@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rab740e5c70424ef79fd095a4b076e752109aeee41c4256c2e5e5e142@%3Ccommits.pulsar.apache.org%3E
- https://pkg.go.dev/vuln/GO-2021-0101
- https://www.oracle.com/security-alerts/cpujul2021.html
More Apache Thrift vulnerabilities
- TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
- TI-2016-04675 Command injection in Apache Thrift CVSS 3.0HIGH 8.8
- TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
- TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
- TI-2026-40371 Integer overflow in Apache Thrift CVSS 4.0HIGH 8.7
- TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7
Sources
- CVE-2019-0210 · CVE Program
- CVE-2019-0210 · NVD
- FIRST EPSS
- GHSA-jq7p-26h5-w78r · GitHub Advisory Database · CC BY 4.0
- CVE-2019-0210 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences