Threats affecting pkg:nuget/ApacheThrift

CVE-2026-66055 is a high severity vulnerability in Apache Thrift affecting multiple language bindings including C++, Java, Go, netstd, Python, and Delphi. The flaw involves allocation of resources without limits or throttling, which can lead to resource exhaustion. This issue affects all versions prior to 0.25.0. Apache has released version 0.25.0 to address this vulnerability.

CVE-2026-82458 is a high-severity vulnerability in Apache Thrift before version 0.25.0 involving memory allocation with an excessive size value. This flaw affects multiple language bindings including Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D. The issue allows allocation of resources without limits or throttling, potentially leading to resource exhaustion. The vulnerability is fixed in Apache Thrift version 0.25.0.

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.