Threats affecting pkg:composer/apache/thrift

CVE-2026-96289 is a high-severity vulnerability in Apache Thrift's PHP bindings caused by uncontrolled recursion. This flaw affects all versions before 0.25.0. The issue has been addressed in Apache Thrift version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

CVE-2026-66858 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves uncontrolled recursion in the protocol skip routine of several Apache Thrift bindings, which do not enforce the binding's recursion limit. This can lead to stack exhaustion when processing deeply nested unknown fields. The affected components include the Python C++ accelerator, PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk, and OCaml libraries. The issue is fixed in Apache Thrift version 0.25.0.

CVE-2026-66837 is a high-severity stack-based buffer overflow and integer overflow vulnerability in the PHP bindings of Apache Thrift. It affects all versions prior to 0.25.0. The issue allows for potential memory corruption due to improper handling of buffer sizes. Apache has released version 0.25.0 to address this vulnerability.

CVE-2026-94653 is a high-severity vulnerability in Apache Thrift affecting PHP bindings before version 0.25.0. It involves inefficient algorithmic complexity, which can lead to performance degradation or denial of service. The issue is fixed in Apache Thrift version 0.25.0.

CVE-2026-94638 is a resource allocation vulnerability in Apache Thrift's PHP bindings affecting versions before 0.25.0. It allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The issue is fixed in version 0.25.0.

NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

An uncaught exception vulnerability exists in the Apache Thrift PHP bindings before version 0.25.0. This flaw can cause unhandled exceptions during execution, leading to high-severity impacts. The issue is fixed in Apache Thrift version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

CVE-2026-94644 is a high-severity vulnerability in Apache Thrift PHP bindings involving allocation of resources without limits or throttling. This flaw affects Apache Thrift versions before 0.25.0. The issue allows uncontrolled resource consumption, which could lead to denial of service or other resource exhaustion impacts. The vulnerability is fixed in Apache Thrift version 0.25.0.

CVE-2026-85494 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves improper handling of length parameter inconsistencies leading to uncaught exceptions, inefficient algorithmic complexity, excessive memory allocation, and insecure resource initialization across multiple language bindings. The issue is fixed in version 0.25.0.

CVE-2026-91137 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves improper validation of specified quantity in input, leading to allocation of resources without limits or throttling and excessive iteration in the PHP bindings. This can cause resource exhaustion or denial of service. The issue is fixed in Apache Thrift version 0.25.0.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.