Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route

Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)

Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)

Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)

Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec

Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available

Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception

Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)

Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements

Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id

Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path

Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Apache Thrift: c_glib `read_all` spins when the underlying read returns 0

Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard

Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)

Apache Thrift: Perl servers end `serve()` when serving one connection fails

Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic

Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame

Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)

Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame

Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service

Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process

Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)

Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound

Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound

Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)

Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

Apache Thrift: Swift Range crash in skip()

Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

Apache Thrift: Rust binary protocol non-strict path missing string size limit