CVE-2016-5397
Apache Thrift Go Library Command Injection
CVE-2016-5397 is a high vulnerability (CVSS 8.8) in Apache Thrift, published February 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.87%, the 94th percentile. Fixed in github.com/apache/thrift 0.10.0.
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
CVE-2016-5397- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
CVE-2016-5397- Updated
- 2026-11-02
EUVDEUVD-2022-5087 No score
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
EUVD-2022-5087- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r4m4-pmvw-m6j5
Apache Thrift Go Library Command Injection
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
GHSA-r4m4-pmvw-m6j5- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
CVE-2016-5397- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-5397
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
DEBIAN-CVE-2016-5397- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-r4m4-pmvw-m6j5
Apache Thrift Go Library Command Injection
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
GHSA-r4m4-pmvw-m6j5- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-5397
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
- Record
UBUNTU-CVE-2016-5397- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1765843686 No score
TuxCare security update for org.apache.thrift (2 CVEs)
TuxCare rebuilt 2 org.apache.thrift packages to address 2 CVEs. Fixed in 0.9.1-tuxcare.1.
- Record
CLSA-2025-1765843686- Updated
- 2026-11-02
OSVCLSA-2026-1772756024 No score
TuxCare security update for org.apache.thrift (4 CVEs)
TuxCare rebuilt 2 org.apache.thrift packages to address 4 CVEs. Fixed in 0.9.3-tuxcare.2.
- Record
CLSA-2026-1772756024- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/apache/thriftGo |
through 0.9.3 | 0.10.0 |
org.apache.thrift:libfb303TuxCare:Maven |
0.9.1 up to 0.9.1-tuxcare.1 | 0.9.1-tuxcare.1 |
org.apache.thrift:libthriftTuxCare:Maven |
0.9.1 up to 0.9.1-tuxcare.1 | 0.9.1-tuxcare.1 |
org.apache.thrift:libfb303TuxCare:Maven |
0.9.3 up to 0.9.3-tuxcare.2, plus listed versions 0.9.3.tuxcare.1 |
0.9.3-tuxcare.2 |
org.apache.thrift:libthriftTuxCare:Maven |
0.9.3 up to 0.9.3-tuxcare.2, plus listed versions 0.9.3.tuxcare.1 |
0.9.3-tuxcare.2 |
thriftDebian:12 |
before 0.11.0-3 | 0.11.0-3 |
thriftDebian:13 |
before 0.11.0-3 | 0.11.0-3 |
thriftDebian:14 |
before 0.11.0-3 | 0.11.0-3 |
github.com/apache/thriftGo |
before 0.10.0 | 0.10.0 |
thrift-compilerUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.1-2 |
None known |
thrift-compilerUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.1-2.1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/103025
access.redhat.com/errata/RHSA-2018:2669
issues.apache.org/jira/browse/THRIFT-3893
mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-5397
web.archive.org/web/20210124141102/http://www.securityfocus.com/bid/103025
github.com/advisories/GHSA-r4m4-pmvw-m6j5
security-tracker.debian.org/tracker/CVE-2016-5397
ubuntu.com/security/CVE-2016-5397
cve.org/CVERecord?id=CVE-2016-5397