TH
Product
Thrift
32
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 21Medium 7Low 0
Watch
Add Thrift to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-5397 | 8.8 | Feb 12 | The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool Affected: through 0.9.3 |
| CVE-2026-41604 | 8.2 | Apr 28 | Apache Thrift: Swift Range crash in skip() Affected: before 0.23.0 |
| CVE-2026-58389 | 7.5 | Jul 27 | Apache Thrift: Rust binary protocol non-strict path missing string size limit Affected: before 0.24.0 |
| CVE-2026-55969 | 7.5 | Jul 27 | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() Affected: before 0.24.0 |
| CVE-2026-55968 | 7.5 | Jul 27 | Apache Thrift: Node.js quadratic-time DoS in server receive transports Affected: before 0.24.0 |
| CVE-2026-49158 | 7.5 | Jul 27 | Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb Affected: before 0.24.0 |
| CVE-2026-48586 | 7.5 | Jul 27 | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit Affected: before 0.24.0 |
| CVE-2026-48145 | 7.5 | Jul 27 | Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass Affected: before 0.24.0 |
| CVE-2026-45112 | 7.5 | Jul 27 | Apache Thrift: Unbounded Read Leading to Denial of Service Affected: 0.19.0 before 0.24.0 |
| CVE-2026-43871 | 7.5 | Jul 27 | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit Affected: before 0.24.0 |
| CVE-2026-41608 | 7.5 | Jul 27 | Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport Affected: before 0.24.0 |
| CVE-2026-41636 | 7.5 | Apr 28 | Apache Thrift: Node.js skip() recursion Affected: before 0.23.0 |
| CVE-2026-41602 | 7.5 | Apr 28 | Apache Thrift: Go TFramedTransport uint32 overflow Affected: before 0.23.0 |
| CVE-2025-48431 | 7.5 | Apr 28 | Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. Affected: before 0.23.0 |
| CVE-2020-13949 | 7.5 | Feb 12 | In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service Affected: 0.9.3 through 0.13.0 |
| CVE-2019-0210 | 7.5 | Oct 29 | In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data Affected: 0.9.3 through 0.12.0 |
| CVE-2019-0205 | 7.5 | Oct 29 | In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data Affected: through 0.12.0 |
| CVE-2018-1320 | 7.5 | Jan 7 | Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class Affected: 0.5.0 through 0.11.0 |
| CVE-2026-43870 | 7.3 | May 5 | Apache Thrift: Node.js web_server.js multi-vulnerability Affected: before 0.23.0 |
| CVE-2026-43869 | 7.3 | May 5 | Apache Thrift: TSSLTransportFactory.java hostname verification Affected: before 0.23.0 |
| CVE-2026-41605 | 7.3 | Apr 28 | Apache Thrift: Swift Compact Protocol integer overflow Affected: before 0.23.0 |
Showing 21