Thrift vulnerabilities

23 known vulnerabilities in Thrift from Apache. 23 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-58662Jul 27, 2026ApacheEPSS 1.08%

  Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-58389Jul 27, 2026ApacheEPSS 1.03%

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 9.1 Critical severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-58023Jul 27, 2026ApacheEPSS 1.02%

  Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 9.8 Critical severity

  Apache Thrift: Heap-based Buffer Overflow

  CVE-2026-55971Jul 27, 2026Apache

  Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Integer Overflow or Wraparound

  CVE-2026-55969Jul 27, 2026ApacheEPSS 1.03%

  Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Inefficient Algorithmic Complexity

  CVE-2026-55968Jul 27, 2026ApacheEPSS 1.03%

  Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue

• 7.5 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-49158Jul 27, 2026ApacheEPSS 1.03%

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-48586Jul 27, 2026ApacheEPSS 1.03%

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issu

• 7.5 High severity

  Apache Thrift: Improper Validation of Certificate with Host Mismatch

  CVE-2026-48145Jul 27, 2026Apache

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 9.1 Critical severity

  Apache Thrift: Improper Validation of Certificate with Host Mismatch

  CVE-2026-48144Jul 27, 2026Apache

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Allocation of Resources Without Limits or Throttling

  CVE-2026-45112Jul 27, 2026ApacheEPSS 1.03%

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Loop with Unreachable Exit Condition

  CVE-2026-43871Jul 27, 2026ApacheEPSS 1.03%

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-41608Jul 27, 2026ApacheEPSS 1.03%

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

• 7.3 High severity

  Apache Thrift: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-43870May 5, 2026Apache

  Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Th

• 7.5 High severity

  Apache Thrift: Memory Allocation with Excessive Size Value

  CVE-2026-43868May 5, 2026Apache

  Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.3 High severity

  Apache Thrift: Improper Validation of Certificate with Host Mismatch

  CVE-2026-43869May 5, 2026Apache

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-41636Apr 28, 2026Apache

  Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 9.1 Critical severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-41607Apr 28, 2026Apache

  Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Uncontrolled Recursion

  CVE-2026-41606Apr 28, 2026ApacheEPSS 1.1%

  Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.7 High severity

  Apache Thrift: Integer Overflow or Wraparound

  CVE-2026-41605Apr 28, 2026Apache

  Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 8.2 High severity

  Apache Thrift: Out-of-bounds Read

  CVE-2026-41604Apr 28, 2026Apache

  Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Integer Overflow or Wraparound

  CVE-2026-41602Apr 28, 2026ApacheEPSS 1.16%

  Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

• 7.5 High severity

  Apache Thrift: Mismatched Memory Management Routines

  CVE-2025-48431Apr 28, 2026ApacheEPSS 1.04%

  Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests c