CWE-770: Unthrottled Resource Allocation vulnerabilities

CVE-2026-96288 is a high-severity vulnerability in Apache Thrift's Erlang bindings involving uncontrolled recursion and unbounded resource allocation. This flaw affects versions prior to 0.25.0 and can lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94648 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves allocation of resources without limits or throttling in the Dart bindings, which can lead to resource exhaustion. The issue is fixed in version 0.25.0.

CVE-2026-94638 is a resource allocation vulnerability in Apache Thrift's PHP bindings affecting versions before 0.25.0. It allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The issue is fixed in version 0.25.0.

CVE-2026-82458 is a high-severity vulnerability in Apache Thrift before version 0.25.0 involving memory allocation with an excessive size value. This flaw affects multiple language bindings including Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D. The issue allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The vulnerability is fixed in Apache Thrift version 0.25.0.

CVE-2026-61373 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves allocation of resources without limits or throttling in the Java TSaslNonblockingServer component. This flaw can lead to resource exhaustion, potentially impacting service availability. The issue is fixed in Apache Thrift version 0.25.0.

CVE-2026-96990 is a high-severity vulnerability in Apache Thrift's Erlang bindings involving allocation of resources without limits or throttling. This flaw affects versions before 0.25.0 and can lead to resource exhaustion. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

CVE-2026-94644 is a high-severity vulnerability in Apache Thrift PHP bindings involving allocation of resources without limits or throttling. This flaw affects Apache Thrift versions before 0.25.0. The issue allows uncontrolled resource consumption, which could lead to denial of service or other resource exhaustion impacts. The vulnerability is fixed in Apache Thrift version 0.25.0.

CVE-2026-94645 is a high-severity vulnerability in Apache Thrift's Node.js bindings involving improper validation of specified quantity in input, leading to allocation of resources without limits or throttling. This flaw affects all versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

CVE-2026-91137 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves improper validation of specified quantity in input, leading to allocation of resources without limits or throttling and excessive iteration in the PHP bindings. This can cause resource exhaustion or denial of service. The issue is fixed in Apache Thrift version 0.25.0.

A vulnerability in Apache Thrift Lua bindings allows allocation of resources without limits or throttling due to improper handling of length parameter inconsistency. This affects versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade.

Apache Thrift Java bindings prior to version 0.25.0 contain a vulnerability caused by improper handling of exceptional conditions, including allocation of resources without limits and uncaught exceptions. This can lead to resource exhaustion or application instability. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

CVE-2026-94634 is a high-severity vulnerability in Apache Thrift Python bindings affecting versions before 0.25.0. It involves allocation of resources without limits or throttling and initialization of a resource with insecure defaults. The issue is fixed in Apache Thrift version 0.25.0.