Apache Software Foundation Apache Thrift
29 CVEs affecting Apache Software Foundation Apache Thrift. Latest disclosed: 2026-07-27. Critical: 4, High: 19.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55971 | Critical | 9.8 | 2026-07-27 | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to… |
CVE-2026-58662 | Critical | 9.1 | 2026-07-27 | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0… |
CVE-2026-58023 | Critical | 9.1 | 2026-07-27 | Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to versi… |
CVE-2026-48144 | Critical | 9.1 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users… |
CVE-2016-5397 | High | 8.8 | 2018-02-12 | The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apach… |
CVE-2026-41604 | High | 8.2 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-58389 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are… |
CVE-2026-55969 | High | 7.5 | 2026-07-27 | Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24… |
CVE-2026-55968 | High | 7.5 | 2026-07-27 | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects A… |
CVE-2026-49158 | High | 7.5 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0… |
CVE-2026-48586 | High | 7.5 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects… |
CVE-2026-48145 | High | 7.5 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are… |
CVE-2026-45112 | High | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0… |
CVE-2026-43871 | High | 7.5 | 2026-07-27 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: befor… |
CVE-2026-41608 | High | 7.5 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24… |
CVE-2026-41636 | High | 7.5 | 2026-04-28 | Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to v… |
CVE-2026-41602 | High | 7.5 | 2026-04-28 | Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Us… |
CVE-2025-48431 | High | 7.5 | 2026-04-28 | Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are rec… |
CVE-2018-1320 | High | 7.5 | 2019-01-07 | Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTrans… |
CVE-2026-43870 | High | 7.3 | 2026-05-05 | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Head… |