You are viewing a plain text version of this content. The canonical link for it is here.
- CVE-2026-82458: Apache Thrift: Container element count not bounded by the bytes available - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:39 UTC, 0 replies.
- CVE-2026-82459: Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:47 UTC, 0 replies.
- CVE-2026-83632: Apache Thrift: C++ THttpTransport grows its line buffer without bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:56 UTC, 0 replies.
- CVE-2026-83663: Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:03 UTC, 0 replies.
- CVE-2026-83745: Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:11 UTC, 0 replies.
- CVE-2026-85086: Apache Thrift: Perl TLS client disables certificate verification by default - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:18 UTC, 0 replies.
- CVE-2026-85087: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:27 UTC, 0 replies.
- CVE-2026-85088: Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:37 UTC, 0 replies.
- CVE-2026-85476: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0 - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:51 UTC, 0 replies.
- CVE-2026-85483: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:56 UTC, 0 replies.
- CVE-2026-85493: Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:09 UTC, 0 replies.
- CVE-2026-85494: Apache Thrift: Framed transport and binary protocol size a read buffer from a peer-declared length with no effective maximum (multi-language) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:16 UTC, 0 replies.
- CVE-2026-86535: Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:20 UTC, 0 replies.
- CVE-2026-86536: Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:26 UTC, 0 replies.
- CVE-2026-86537: Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:31 UTC, 0 replies.
- CVE-2026-87117: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:35 UTC, 0 replies.
- CVE-2026-90440: Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:43 UTC, 0 replies.
- CVE-2026-91135: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:56 UTC, 0 replies.
- CVE-2026-91137: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:05 UTC, 0 replies.
- CVE-2026-92834: Apache Thrift: C++ WebSocket server transport does not read a full request length - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:15 UTC, 0 replies.
- CVE-2026-93925: Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:20 UTC, 0 replies.
- CVE-2026-93926: Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:26 UTC, 0 replies.
- CVE-2026-94633: Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:34 UTC, 0 replies.
- CVE-2026-94634: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:40 UTC, 0 replies.
- CVE-2026-96289: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:16 UTC, 0 replies.
- CVE-2026-94652: Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:25 UTC, 0 replies.
- CVE-2026-94653: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:33 UTC, 0 replies.
- CVE-2026-94646: Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:42 UTC, 0 replies.
- CVE-2026-94648: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:50 UTC, 0 replies.
- CVE-2026-94657: Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:18 UTC, 0 replies.
- CVE-2026-94658: Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:24 UTC, 0 replies.
- CVE-2026-96277: Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:32 UTC, 0 replies.
- CVE-2026-96286: Apache Thrift: Perl servers end `serve()` when serving one connection fails - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:39 UTC, 0 replies.
- CVE-2026-94635: Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:21 UTC, 0 replies.
- CVE-2026-94636: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:26 UTC, 0 replies.
- CVE-2026-94637: Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:33 UTC, 0 replies.
- CVE-2026-94638: Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize` - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:42 UTC, 0 replies.
- CVE-2026-94639: Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:48 UTC, 0 replies.
- CVE-2026-94654: Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:29 UTC, 0 replies.
- CVE-2026-94655: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:35 UTC, 0 replies.
- CVE-2026-94656: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:42 UTC, 0 replies.
- CVE-2026-96287: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:53 UTC, 0 replies.
- CVE-2026-96288: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:55:00 UTC, 0 replies.
- CVE-2026-96292: Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:55:43 UTC, 0 replies.
- CVE-2026-96294: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:30 UTC, 0 replies.
- CVE-2026-96990: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:36 UTC, 0 replies.
- CVE-2026-94642: Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:45 UTC, 0 replies.
- CVE-2026-94644: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:55 UTC, 0 replies.
- CVE-2026-94645: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:57:01 UTC, 0 replies.
- CVE-2026-94650: Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:57:13 UTC, 0 replies.
- CVE-2026-94651: Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:57:52 UTC, 0 replies.