thrift vulnerabilities (Debian)
92 vulnerabilities.
thriftDebianApache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error8.2 HighthriftDebianApache Thrift: c_glib TZlibTransport reports a full read after a premature stream end6.3 MediumthriftDebianApache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)8.7 HighthriftDebianApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pee…8.7 HighthriftDebianApache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)9.2 CriticalthriftDebianApache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements8.7 HighthriftDebianApache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id8.7 HighthriftDebianApache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path8.7 HighthriftDebianApache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length8.7 HighthriftDebianApache Thrift: Python `TJSONProtocol` has a string length limit that is off by default8.2 HighthriftDebianApache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)8.2 HighthriftDebianApache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name8.7 HighthriftDebianApache Thrift: Python TSSLSocket Hostname Matcher Import5.9 MediumthriftDebianApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass8.7 HighthriftDebianApache Thrift: Rust binary protocol non-strict path missing string size limit8.7 HighthriftDebianApache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path6.9 MediumthriftDebianApache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()9.3 CriticalthriftDebianApache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()6.9 MediumthriftDebianApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()8.7 HighthriftDebianApache Thrift: Node.js quadratic-time DoS in server receive transports8.7 HighthriftDebianApache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb7.5 HighthriftDebianApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit8.7 HighthriftDebianApache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass8.2 HighthriftDebianApache Thrift: c_glib TLS Client Missing Hostname Verification9.1 CriticalthriftDebianApache Thrift: Unbounded Read Leading to Denial of Service6.9 MediumthriftDebianApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit8.7 HighthriftDebianApache Thrift: Unbounded Zlib Decompression in Python THeaderTransport7.5 HighthriftDebianApache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern5.3 MediumthriftDebianApache Thrift: Node.js web_server.js multi-vulnerability7.3 HighthriftDebianApache Thrift: TSSLTransportFactory.java hostname verification7.3 HighthriftDebianApache Thrift: Node.js skip() recursion8.7 HighthriftDebianApache Thrift: C++ JSON OOB read6.5 MediumthriftDebianApache Thrift: c_glib dispatch stack overflow5.3 MediumthriftDebianApache Thrift: Swift Compact Protocol integer overflow7.3 HighthriftDebianApache Thrift: Swift Range crash in skip()8.2 HighthriftDebianApache Thrift: Go TFramedTransport uint32 overflow7.5 HighthriftDebianApache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.7.5 HighthriftDebianUncontrolled Resource Consumption in Apache Thrift7.5 HighthriftDebianLoop with Unreachable Exit Condition in Apache Thrift7.5 HighthriftDebianOut-of-bounds read in Apache Thrift7.5 HighthriftDebianApache Thrift Node.js static web server sandbox escape6.5 MediumthriftDebianApache Thrift Go Library Command Injection8.8 High