AT
Product
Apache Thrift
86
CVEs
0
On KEV
9.8
Max CVSS
61
New 30D
Severity mix
Critical 6High 65Medium 15Low 0
Watch
Add Apache Thrift to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-94634 | 8.2 | Oct 2 | Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default Affected: before 0.25.0 |
| CVE-2026-94639 | 8.2 | Oct 2 | Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) Affected: before 0.25.0 |
| CVE-2026-41604 | 8.2 | Apr 28 | Apache Thrift: Swift Range crash in skip() Affected: before 0.23.0 |
| CVE-2026-94651 | 7.5 | Oct 2 | Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error Affected: before 0.25.0 |
| CVE-2026-85494 | 7.5 | Oct 2 | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language) Affected: before 0.25.0; before 0.25.0; before 0.25.0; before 0.25.0; before 0.25.0; before 0.25.0; +3 more |
| CVE-2026-58389 | 7.5 | Jul 27 | Apache Thrift: Rust binary protocol non-strict path missing string size limit Affected: before 0.24.0 |
| CVE-2026-55969 | 7.5 | Jul 27 | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() Affected: before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0 |
| CVE-2026-55968 | 7.5 | Jul 27 | Apache Thrift: Node.js quadratic-time DoS in server receive transports Affected: before 0.24.0 |
| CVE-2026-49158 | 7.5 | Jul 27 | Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb Affected: before 0.24.0 |
| CVE-2026-48586 | 7.5 | Jul 27 | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit Affected: before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0 |
| CVE-2026-48145 | 7.5 | Jul 27 | Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass Affected: before 0.24.0 |
| CVE-2026-45112 | 7.5 | Jul 27 | Apache Thrift: Unbounded Read Leading to Denial of Service Affected: 0.19.0 before 0.24.0 |
| CVE-2026-43871 | 7.5 | Jul 27 | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit Affected: before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0 |
| CVE-2026-41608 | 7.5 | Jul 27 | Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport Affected: before 0.24.0 |
| CVE-2026-41636 | 7.5 | Apr 28 | Apache Thrift: Node.js skip() recursion Affected: before 0.23.0 |
| CVE-2026-41602 | 7.5 | Apr 28 | Apache Thrift: Go TFramedTransport uint32 overflow Affected: before 0.23.0 |
| CVE-2025-48431 | 7.5 | Apr 28 | Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. Affected: before 0.23.0 |
| CVE-2026-43870 | 7.3 | May 5 | Apache Thrift: Node.js web_server.js multi-vulnerability Affected: before 0.23.0 |
| CVE-2026-43869 | 7.3 | May 5 | Apache Thrift: TSSLTransportFactory.java hostname verification Affected: before 0.23.0 |
| CVE-2026-41605 | 7.3 | Apr 28 | Apache Thrift: Swift Compact Protocol integer overflow Affected: before 0.23.0 |
| CVE-2026-61374 | 7.1 | Oct 2 | Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit Affected: before 0.25.0 |
| CVE-2026-66054 | 6.9 | Oct 2 | Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize Affected: before 0.25.0 |
| CVE-2026-66331 | 6.9 | Oct 2 | Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize Affected: before 0.25.0 |
| CVE-2026-85088 | 6.9 | Oct 2 | Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match Affected: before 0.25.0; before 0.25.0 |
| CVE-2026-85087 | 6.9 | Oct 2 | Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op Affected: before 0.25.0 |
| CVE-2026-85086 | 6.9 | Oct 2 | Apache Thrift: Perl TLS client disables certificate verification by default Affected: before 0.25.0 |
| CVE-2026-55970 | 6.5 | Jul 27 | Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() Affected: before 0.24.0 |
| CVE-2026-41607 | 6.5 | Apr 28 | Apache Thrift: C++ JSON OOB read Affected: before 0.23.0 |
| CVE-2026-94652 | 6.3 | Oct 2 | Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back Affected: before 0.25.0 |
| CVE-2026-94638 | 6.3 | Oct 2 | Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize` Affected: before 0.25.0 |
| CVE-2026-92834 | 6.3 | Oct 2 | Apache Thrift: C++ WebSocket server transport does not read a full request length Affected: before 0.25.0 |
| CVE-2026-86536 | 6.3 | Oct 2 | Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript Affected: before 0.25.0; before 0.25.0; before 0.25.0 |
| CVE-2026-85483 | 6.3 | Oct 2 | Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end Affected: before 0.25.0 |
| CVE-2026-66053 | 5.9 | Jul 27 | Apache Thrift: Python TSSLSocket Hostname Matcher Import Affected: before 0.24.0 |
| CVE-2026-43868 | 5.3 | May 5 | Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern Affected: before 0.23.0 |
| CVE-2026-41606 | 5.3 | Apr 28 | Apache Thrift: c_glib dispatch stack overflow Affected: before 0.23.0 |