Apache Thrift vulnerabilities

75 known vulnerabilities in Apache Thrift from Apache. 75 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-120135Oct 31, 2026Apache

  Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-96289Oct 2, 2026Apache

  Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Inefficient Algorithmic Complexity

  CVE-2026-96287Oct 2, 2026Apache

  Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-96286Oct 2, 2026Apache

  Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-96277Oct 2, 2026Apache

  Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Inefficient Algorithmic Complexity

  CVE-2026-94658Oct 2, 2026Apache

  Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-94657Oct 2, 2026Apache

  Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-94656Oct 2, 2026Apache

  Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Inefficient Algorithmic Complexity

  CVE-2026-94655Oct 2, 2026Apache

  Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Loop with Unreachable Exit Condition

  CVE-2026-94654Oct 2, 2026Apache

  Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Loop with Unreachable Exit Condition

  CVE-2026-85476Oct 2, 2026Apache

  Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Improper Handling of Length Parameter Inconsistency

  CVE-2026-83745Oct 2, 2026Apache

  Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate

• 8.7 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-83663Oct 2, 2026Apache

  Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a fram

• 9.2 Critical severity

  Apache Thrift: Heap-based Buffer Overflow

  CVE-2026-83632Oct 2, 2026Apache

  Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes th

• 8.7 High severity

  Apache Thrift: Use of Uninitialized Variable

  CVE-2026-66859Oct 2, 2026Apache

  NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-66858Oct 2, 2026Apache

  The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affecte

• 8.7 High severity

  Apache Thrift: Stack-based Buffer Overflow

  CVE-2026-66837Oct 2, 2026Apache

  Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Access of Uninitialized Pointer

  CVE-2026-66081Oct 2, 2026Apache

  Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-66055Oct 2, 2026Apache

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-63772Oct 2, 2026Apache

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 7.1 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-61374Oct 2, 2026Apache

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-96294Oct 2, 2026Apache

  Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Inefficient Algorithmic Complexity

  CVE-2026-96292Oct 2, 2026Apache

  Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-96288Oct 2, 2026Apache

  Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Inefficient Algorithmic Complexity

  CVE-2026-94653Oct 2, 2026Apache

  Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-94648Oct 2, 2026Apache

  Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-94646Oct 2, 2026Apache

  Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. U

• 8.2 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-94637Oct 2, 2026Apache

  Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-94636Oct 2, 2026Apache

  Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0

• 8.2 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-90440Oct 2, 2026Apache

  Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to vers

• 8.7 High severity

  Apache Thrift: NULL Pointer Dereference

  CVE-2026-87117Oct 2, 2026Apache

  NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Integer Underflow (Wrap or Wraparound)

  CVE-2026-86537Oct 2, 2026Apache

  Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version

• 8.7 High severity

  Apache Thrift: Loop with Unreachable Exit Condition

  CVE-2026-86535Oct 2, 2026Apache

  Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0

• 8.2 High severity

  Apache Thrift: Integer Underflow (Wrap or Wraparound)

  CVE-2026-82459Oct 2, 2026Apache

  Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-82458Oct 2, 2026Apache

  Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0

• 8.7 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-61373Oct 2, 2026Apache

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-96990Oct 2, 2026Apache

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Improper Handling of Exceptional Conditions

  CVE-2026-94651Oct 2, 2026Apache

  improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the

• 8.2 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-94650Oct 2, 2026Apache

  Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-94645Oct 2, 2026Apache

  Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which