TI-2026-47034 CVE-2026-66053 · GHSA-hwrj-9rr4-24xh
Apache Thrift: Python TSSLSocket Hostname Matcher Import
Priority LOW 26
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings.
Vulnerabilities
32 records
TI-2026-42227 CVE-2026-58662 · GHSA-x4w6-p6f8-24qw
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
Priority MEDIUM 46
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings.
TI-2026-42014 CVE-2026-58389 · GHSA-jx7g-767m-86hp
Apache Thrift: Rust binary protocol non-strict path missing string size limit
Priority MEDIUM 46
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.
TI-2026-41778 CVE-2026-58023 · GHSA-7rjc-4234-rgwm
Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
Priority LOW 38
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings.
TI-2026-40373 CVE-2026-55971 · GHSA-gwj4-q93m-wwqc
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
Priority MEDIUM 50
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.
TI-2026-40372 CVE-2026-55970 · GHSA-g7xp-pggm-c7w2
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
Priority LOW 38
Buffer Over-read vulnerability in Apache Thrift C++ bindings.
TI-2026-40371 CVE-2026-55969 · GHSA-x8jh-qfcv-fp29
Integer overflow in Apache Thrift
Priority MEDIUM 46
Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.
TI-2026-40370 CVE-2026-55968 · GHSA-8cj2-994r-9fpq
Apache Thrift: Node.js quadratic-time DoS in server receive transports
Priority MEDIUM 46
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings.
TI-2026-36362 CVE-2026-49158 · GHSA-jcj7-w43p-gjh8
Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
Priority MEDIUM 41
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.
TI-2026-35942 CVE-2026-48586 · GHSA-6h9h-5c4r-fqgf
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…
Priority MEDIUM 46
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.
TI-2026-35581 CVE-2026-48145 · GHSA-p2c7-c4gw-678h
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
Priority LOW 36
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings.
TI-2026-35580 CVE-2026-48144 · GHSA-367h-9jj5-w29f
Apache Thrift: c_glib TLS Client Missing Hostname Verification
Priority MEDIUM 41
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings.
TI-2026-32947 CVE-2026-45112 · GHSA-g9fj-fh28-776p
Apache Thrift: Unbounded Read Leading to Denial of Service
Priority LOW 38
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.
TI-2026-31935 CVE-2026-43871 · GHSA-8wv5-x4w7-5gww
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Priority MEDIUM 46
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
TI-2026-30149 CVE-2026-41608 · GHSA-6pjx-3pjc-mrj8
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
Priority MEDIUM 41
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings.
TI-2026-31932 CVE-2026-43868 · GHSA-2f9f-gq7v-9h6m
Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern
Priority LOW 31
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.
TI-2026-31934 CVE-2026-43870 · GHSA-526f-jxpj-jmg2
Apache Thrift: Node.js web_server.js multi-vulnerability
Priority LOW 38
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resourc…
TI-2026-31933 CVE-2026-43869 · GHSA-7pwc-h2j2-rjgj
Apache Thrift: TSSLTransportFactory.java hostname verification
Priority LOW 39
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
TI-2026-30157 CVE-2026-41636 · GHSA-r67j-r569-jrwp
Apache Thrift: Node.js skip() recursion
Priority MEDIUM 44
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0.
TI-2026-30148 CVE-2026-41607 · GHSA-7gqw-825c-3842
Apache Thrift: C++ JSON OOB read
Priority LOW 37
Out-of-bounds Read vulnerability in Apache Thrift.
TI-2026-30147 CVE-2026-41606 · GHSA-h5hj-56h4-rwcp
Apache Thrift: c_glib dispatch stack overflow
Priority LOW 32
Uncontrolled Recursion vulnerability in Apache Thrift.
TI-2026-30146 CVE-2026-41605 · GHSA-qcp3-xfwx-5hr4
Apache Thrift: Swift Compact Protocol integer overflow
Priority MEDIUM 40
Integer Overflow or Wraparound vulnerability in Apache Thrift.
TI-2026-30145 CVE-2026-41604 · GHSA-r4rx-ffxv-23vw
Apache Thrift: Swift Range crash in skip()
Priority MEDIUM 43
Out-of-bounds Read vulnerability in Apache Thrift.
TI-2026-30144 CVE-2026-41602 · GHSA-wf45-q9ch-q8gh
Apache Thrift: Go TFramedTransport uint32 overflow
Priority MEDIUM 41
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.
TI-2025-30732 CVE-2025-48431 · GHSA-ppv5-592p-g5q4
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
Priority MEDIUM 41
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.