Threats affecting pkg:maven/org.apache.thrift/thrift

Apache Thrift C++ WebSocket server versions before 0.25.0 contain a vulnerability involving the use of uninitialized resources and returning incorrect status codes. This flaw can cause improper server behavior. The issue has been fixed in version 0.25.0.

CVE-2026-90440 is a high-severity vulnerability in Apache Thrift prior to version 0.25.0. It involves uncaught exceptions and improper handling of exceptional conditions in the thrift.server.nonblocking.TNonblockingServer component, leading to improper resource shutdown. This can cause service disruption or other impacts related to resource management. Users are advised to upgrade to Apache Thrift version 0.25.0, which addresses this issue.

CVE-2026-85493 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves uncontrolled recursion in the Dart and Java ME bindings, which can lead to a denial of service or other impacts. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version.

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-94635 is a high-severity vulnerability in Apache Thrift prior to version 0.25.0. It involves allocation of resources without limits or throttling due to improper handling of length parameter inconsistencies in the Lua bindings. This flaw can lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.

CVE-2026-43870 is a high-severity vulnerability in Apache Thrift before version 0.23.0 involving multiple security weaknesses: origin validation errors (CWE-346), path traversal (CWE-22), HTTP request/response splitting (CWE-113), and uncontrolled resource consumption (CWE-400). These issues can lead to limited confidentiality, integrity, and availability impacts. The Apache Software Foundation recommends upgrading to version 0.23.0 to address these vulnerabilities.

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.