TI-2026-47034 CVE-2026-66053 · GHSA-hwrj-9rr4-24xh
Apache Thrift: Python TSSLSocket Hostname Matcher Import
Priority LOW 26
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings.
Vulnerabilities
15 records
Advisory: Apache Thrift — lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 Clear all filters
TI-2026-42227 CVE-2026-58662 · GHSA-x4w6-p6f8-24qw
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
Priority MEDIUM 46
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings.
TI-2026-42014 CVE-2026-58389 · GHSA-jx7g-767m-86hp
Apache Thrift: Rust binary protocol non-strict path missing string size limit
Priority MEDIUM 46
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.
TI-2026-41778 CVE-2026-58023 · GHSA-7rjc-4234-rgwm
Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
Priority LOW 38
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings.
TI-2026-40373 CVE-2026-55971 · GHSA-gwj4-q93m-wwqc
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
Priority MEDIUM 50
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.
TI-2026-40372 CVE-2026-55970 · GHSA-g7xp-pggm-c7w2
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
Priority LOW 38
Buffer Over-read vulnerability in Apache Thrift C++ bindings.
TI-2026-40371 CVE-2026-55969 · GHSA-x8jh-qfcv-fp29
Integer overflow in Apache Thrift
Priority MEDIUM 46
Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.
TI-2026-40370 CVE-2026-55968 · GHSA-8cj2-994r-9fpq
Apache Thrift: Node.js quadratic-time DoS in server receive transports
Priority MEDIUM 46
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings.
TI-2026-36362 CVE-2026-49158 · GHSA-jcj7-w43p-gjh8
Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
Priority MEDIUM 41
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.
TI-2026-35942 CVE-2026-48586 · GHSA-6h9h-5c4r-fqgf
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…
Priority MEDIUM 46
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.
TI-2026-35581 CVE-2026-48145 · GHSA-p2c7-c4gw-678h
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
Priority LOW 36
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings.
TI-2026-35580 CVE-2026-48144 · GHSA-367h-9jj5-w29f
Apache Thrift: c_glib TLS Client Missing Hostname Verification
Priority MEDIUM 41
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings.
TI-2026-32947 CVE-2026-45112 · GHSA-g9fj-fh28-776p
Apache Thrift: Unbounded Read Leading to Denial of Service
Priority LOW 38
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.
TI-2026-31935 CVE-2026-43871 · GHSA-8wv5-x4w7-5gww
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Priority MEDIUM 46
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
TI-2026-30149 CVE-2026-41608 · GHSA-6pjx-3pjc-mrj8
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
Priority MEDIUM 41
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings.