Threats affecting pkg:maven/Apache Software Foundation/org.apache.thrift:libthrift

CVE-2026-66055 is a high severity vulnerability in Apache Thrift affecting multiple language bindings including C++, Java, Go, netstd, Python, and Delphi. The flaw involves allocation of resources without limits or throttling, which can lead to resource exhaustion. This issue affects all versions prior to 0.25.0. Apache has released version 0.25.0 to address this vulnerability.

CVE-2026-61374 is a high-severity vulnerability in Apache Thrift's Java bindings that involves allocation of resources without limits or throttling. This flaw affects Apache Thrift versions before 0.25.0 and can lead to resource exhaustion. The Apache Software Foundation has addressed this issue in version 0.25.0. Users should upgrade to this fixed version to mitigate the risk.

CVE-2026-82458 is a high-severity vulnerability in Apache Thrift before version 0.25.0 involving memory allocation with an excessive size value. This flaw affects multiple language bindings including Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D. The issue allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The vulnerability is fixed in Apache Thrift version 0.25.0.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94651 is a high-severity vulnerability in Apache Thrift's Java bindings affecting versions before 0.25.0. It involves improper handling of exceptional conditions leading to missing release of resources after their effective lifetime. This flaw is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the issue.

CVE-2026-94639 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves improper handling of exceptional conditions in the Java bindings, specifically allocation of resources without limits or throttling and uncaught exceptions. This flaw can lead to resource exhaustion or application instability. The issue is fixed in Apache Thrift version 0.25.0.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.