Threats affecting pkg:maven/org.apache.thrift/libthrift

Apache Thrift versions prior to 0.25.0 contain a critical vulnerability involving uncontrolled resource allocation, integer overflow or wraparound, and a heap-based buffer overflow. This flaw can lead to severe memory corruption issues. The vulnerability is addressed in version 0.25.0. Users should upgrade to this version to mitigate the risk.

CVE-2026-66055 is a high severity vulnerability in Apache Thrift affecting multiple language bindings including C++, Java, Go, netstd, Python, and Delphi. The flaw involves allocation of resources without limits or throttling, which can lead to resource exhaustion. This issue affects all versions prior to 0.25.0. Apache has released version 0.25.0 to address this vulnerability.

CVE-2026-61374 is a high-severity vulnerability in Apache Thrift's Java bindings that involves allocation of resources without limits or throttling. This flaw affects Apache Thrift versions before 0.25.0 and can lead to resource exhaustion. The Apache Software Foundation has addressed this issue in version 0.25.0. Users should upgrade to this fixed version to mitigate the risk.

Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-82458 is a high-severity vulnerability in Apache Thrift before version 0.25.0 involving memory allocation with an excessive size value. This flaw affects multiple language bindings including Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D. The issue allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The vulnerability is fixed in Apache Thrift version 0.25.0.

A memory and resource leak vulnerability exists in Apache Thrift's THeaderTransport component prior to version 0.25.0. The flaw involves missing release of memory and resources after their effective lifetime, which can lead to resource exhaustion. This issue is resolved in Apache Thrift version 0.25.0.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94651 is a high-severity vulnerability in Apache Thrift's Java bindings affecting versions before 0.25.0. It involves improper handling of exceptional conditions leading to missing release of resources after their effective lifetime. This flaw is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the issue.

CVE-2026-94639 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves improper handling of exceptional conditions in the Java bindings, specifically allocation of resources without limits or throttling and uncaught exceptions. This flaw can lead to resource exhaustion or application instability. The issue is fixed in Apache Thrift version 0.25.0.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.