Apache Thrift vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

AT

Product

Apache Thrift

by Apache Software Foundation · last CVE Oct 2, 2026

86

CVEs

0

On KEV

9.8

Max CVSS

61

New 30D

Vulnerabilities86 In the news0 Timeline

Severity mix

Critical 6High 65Medium 15Low 0

Severity

All severities86 Critical6 High65 Medium15 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Apache Thrift to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-55969	7.5	1%	Jul 27	Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() Affected: before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0
CVE-2026-55968	7.5	1%	Jul 27	Apache Thrift: Node.js quadratic-time DoS in server receive transports Affected: before 0.24.0
CVE-2026-49158	7.5	1%	Jul 27	Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb Affected: before 0.24.0
CVE-2026-48586	7.5	1%	Jul 27	Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit Affected: before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0
CVE-2026-48145	7.5	0%	Jul 27	Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass Affected: before 0.24.0
CVE-2026-45112	7.5	1%	Jul 27	Apache Thrift: Unbounded Read Leading to Denial of Service Affected: 0.19.0 before 0.24.0
CVE-2026-43871	7.5	1%	Jul 27	Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit Affected: before 0.24.0; before 0.24.0; before 0.24.0; before 0.24.0
CVE-2026-41608	7.5	1%	Jul 27	Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport Affected: before 0.24.0
CVE-2026-41636	7.5	0%	Apr 28	Apache Thrift: Node.js skip() recursion Affected: before 0.23.0
CVE-2026-41602	7.5	1%	Apr 28	Apache Thrift: Go TFramedTransport uint32 overflow Affected: before 0.23.0
CVE-2025-48431	7.5	1%	Apr 28	Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. Affected: before 0.23.0
CVE-2026-43870	7.3	0%	May 5	Apache Thrift: Node.js web_server.js multi-vulnerability Affected: before 0.23.0
CVE-2026-43869	7.3	1%	May 5	Apache Thrift: TSSLTransportFactory.java hostname verification Affected: before 0.23.0
CVE-2026-41605	7.3	1%	Apr 28	Apache Thrift: Swift Compact Protocol integer overflow Affected: before 0.23.0
CVE-2026-61374	7.1	0%	Oct 2	Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit Affected: before 0.25.0