CVE-2026-104712 is an asymmetric resource consumption vulnerability in Apache Struts affecting versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The flaw occurs when a request parameter bound to a BigDecimal property is rendered via the Struts tag library, causing the response size to amplify significantly. This allows an unauthenticated attacker to exhaust server CPU and network resources with low-volume traffic. Upgrading to Apache Struts versions 6.12.0 or 7.4.0 mitigates the issue.
CVE-2026-104711 is a critical vulnerability in Apache Struts involving improper neutralization of special elements in expression language statements, leading to expression language injection. This flaw affects applications configured to use the legacy RESTful action mapper, allowing crafted requests to inject OGNL expressions that may result in remote code execution. Struts 7 is vulnerable only if the OGNL allowlist is disabled, which is not the default setting. Other action mappers and the Struts REST plugin are not affected. The vulnerability impacts multiple Struts versions from 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Upgrading to versions 6.12.0 or 7.4.0 addresses the issue.
CVE-2026-59265 is a high-severity code execution vulnerability in Apache OpenOffice up to version 4.1.16. It arises from an untrusted search path issue in the Java integration, allowing a crafted document to execute arbitrary code when opened. The issue is fixed in version 4.1.17, currently in release candidate phase. Users can mitigate the risk by disabling Java runtime integration or avoiding opening untrusted files until the update is applied.
CVE-2026-96289 is a high-severity vulnerability in Apache Thrift's PHP bindings caused by uncontrolled recursion. This flaw affects all versions before 0.25.0. The issue has been addressed in Apache Thrift version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
Apache Thrift versions before 0.25.0 contain an uncaught exception vulnerability in the Perl bindings. This flaw can lead to high-severity impacts if exploited. The issue is resolved in version 0.25.0, which users are advised to upgrade to.
CVE-2026-83663 is an uncontrolled recursion vulnerability in the Go bindings of Apache Thrift before version 0.25.0. The issue arises because the Go transports read frames recursively when encountering frames with no payload bytes, leading to unbounded recursion depth. This causes the Go runtime stack limit to be exceeded, resulting in a fatal error that terminates the entire process. The vulnerability has a high severity with a CVSS score of 8.7. Users are advised to upgrade to Apache Thrift version 0.25.0, which contains the fix.
CVE-2026-66859 is a high severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves a NULL Pointer Dereference and use of uninitialized variable in the c_glib bindings. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-66858 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves uncontrolled recursion in the protocol skip routine of several Apache Thrift bindings, which do not enforce the binding's recursion limit. This can lead to stack exhaustion when processing deeply nested unknown fields. The affected components include the Python C++ accelerator, PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk, and OCaml libraries. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-66837 is a high-severity stack-based buffer overflow and integer overflow vulnerability in the PHP bindings of Apache Thrift. It affects all versions prior to 0.25.0. The issue allows for potential memory corruption due to improper handling of buffer sizes. Apache has released version 0.25.0 to address this vulnerability.
CVE-2026-66055 is a high severity vulnerability in Apache Thrift affecting multiple language bindings including C++, Java, Go, netstd, Python, and Delphi. The flaw involves allocation of resources without limits or throttling, which can lead to resource exhaustion. This issue affects all versions prior to 0.25.0. Apache has released version 0.25.0 to address this vulnerability.
CVE-2026-66054 is a medium severity vulnerability in Apache Thrift C++ bindings that involves allocation of resources without limits or throttling. This flaw leads to improper handling of highly compressed data, resulting in potential data amplification issues. The vulnerability affects Apache Thrift versions prior to 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-61374 is a high-severity vulnerability in Apache Thrift's Java bindings that involves allocation of resources without limits or throttling. This flaw affects Apache Thrift versions before 0.25.0 and can lead to resource exhaustion. The Apache Software Foundation has addressed this issue in version 0.25.0. Users should upgrade to this fixed version to mitigate the risk.
CVE-2026-63772 is a high-severity vulnerability in Apache Thrift's Go bindings involving allocation of resources without limits or throttling. This flaw affects all versions before 0.25.0. The issue can lead to resource exhaustion due to uncontrolled allocation. The Apache Software Foundation has fixed the vulnerability in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.
CVE-2026-66331 is a resource allocation vulnerability in Apache Thrift affecting versions before 0.25.0. It involves the Delphi bindings buffered transport component, where resources can be allocated without proper limits or throttling. This can potentially lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-94636 is a high-severity vulnerability in Apache Thrift's Python bindings affecting versions before 0.25.0. It involves improper handling of highly compressed data leading to data amplification, incorrect function call arguments, and improper validation of input quantities. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-94646 is a high-severity vulnerability in Apache Thrift's Node.js bindings affecting versions before 0.25.0. It involves uncaught exceptions, improper validation of input quantities, and prototype pollution due to improperly controlled modification of object prototype attributes. This vulnerability can lead to significant security risks if exploited. Users are advised to upgrade to version 0.25.0, which addresses and fixes the issue.
CVE-2026-90440 is a high-severity vulnerability in Apache Thrift prior to version 0.25.0. It involves uncaught exceptions and improper handling of exceptional conditions in the thrift.server.nonblocking.TNonblockingServer component, leading to improper resource shutdown. This can cause service disruption or other impacts related to resource management. Users are advised to upgrade to Apache Thrift version 0.25.0, which addresses this issue.
CVE-2026-86537 is a high-severity vulnerability in Apache Thrift's D language bindings affecting versions before 0.25.0. It involves an uncaught exception, an infinite loop due to an unreachable exit condition, and an integer underflow (wraparound). The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.