Apache Thrift vulnerabilities

75 known vulnerabilities in Apache Thrift from Apache. 75 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-94644Oct 2, 2026Apache

  Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-94642Oct 2, 2026Apache

  Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Improper Handling of Length Parameter Inconsistency

  CVE-2026-94633Oct 2, 2026Apache

  Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the

• 8.7 High severity

  Apache Thrift: Missing Release of Memory after Effective Lifetime

  CVE-2026-93926Oct 2, 2026Apache

  Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which

• 8.7 High severity

  Apache Thrift: Stack-based Buffer Overflow

  CVE-2026-93925Oct 2, 2026Apache

  Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.7 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-91137Oct 2, 2026Apache

  Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to vers

• 9.2 Critical severity

  Apache Thrift: Heap-based Buffer Overflow

  CVE-2026-91135Oct 2, 2026Apache

  Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits.

• 8.7 High severity

  Apache Thrift: Improper Handling of Length Parameter Inconsistency

  CVE-2026-85494Oct 2, 2026Apache

  Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang,

• 8.7 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-85493Oct 2, 2026Apache

  Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Uncaught Exception

  CVE-2026-94639Oct 2, 2026Apache

  improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.2

• 8.7 High severity

  Apache Thrift: Improper Handling of Length Parameter Inconsistency

  CVE-2026-94635Oct 2, 2026Apache

  Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fi

• 8.2 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-94634Oct 2, 2026Apache

  Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, whi

• 9.1 Critical severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-58662Jul 27, 2026ApacheEPSS 1.08%

  Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-58389Jul 27, 2026ApacheEPSS 1.03%

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 9.1 Critical severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-58023Jul 27, 2026ApacheEPSS 1.02%

  Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 9.8 Critical severity

  Apache Thrift: Heap-based Buffer Overflow

  CVE-2026-55971Jul 27, 2026Apache

  Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Integer Overflow or Wraparound

  CVE-2026-55969Jul 27, 2026ApacheEPSS 1.03%

  Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Inefficient Algorithmic Complexity

  CVE-2026-55968Jul 27, 2026ApacheEPSS 1.03%

  Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue

• 7.5 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-49158Jul 27, 2026ApacheEPSS 1.03%

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-48586Jul 27, 2026ApacheEPSS 1.03%

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issu

• 7.5 High severity

  Apache Thrift: Improper Validation of Certificate with Host Mismatch

  CVE-2026-48145Jul 27, 2026Apache

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 9.1 Critical severity

  Apache Thrift: Improper Validation of Certificate with Host Mismatch

  CVE-2026-48144Jul 27, 2026Apache

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-45112Jul 27, 2026ApacheEPSS 1.03%

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Loop with Unreachable Exit Condition

  CVE-2026-43871Jul 27, 2026ApacheEPSS 1.03%

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-41608Jul 27, 2026ApacheEPSS 1.03%

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.3 High severity

  Apache Thrift: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-43870May 5, 2026Apache

  Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Th

• 7.5 High severity

  Apache Thrift: Memory Allocation with Excessive Size Value

  CVE-2026-43868May 5, 2026Apache

  Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.3 High severity

  Apache Thrift: Improper Validation of Certificate with Host Mismatch

  CVE-2026-43869May 5, 2026Apache

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-41636Apr 28, 2026Apache

  Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 9.1 Critical severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-41607Apr 28, 2026Apache

  Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-41606Apr 28, 2026ApacheEPSS 1.1%

  Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.7 High severity

  Apache Thrift: Integer Overflow or Wraparound

  CVE-2026-41605Apr 28, 2026Apache

  Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-41604Apr 28, 2026Apache

  Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Integer Overflow or Wraparound

  CVE-2026-41602Apr 28, 2026ApacheEPSS 1.16%

  Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Mismatched Memory Management Routines

  CVE-2025-48431Apr 28, 2026ApacheEPSS 1.04%

  Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests c