Apache Thrift vulnerabilities

• apache thrift Apache Thrift: Python TSSLSocket Hostname Matcher Import CVE-2026-66053 Fix available 5.9 MediumJuly 27, 2026
• apache thrift Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVE-2026-58662 Fix available 8.7 HighJuly 27, 2026
• apache thrift Apache Thrift: Rust binary protocol non-strict path missing string size limit CVE-2026-58389 Fix available 8.7 HighJuly 27, 2026
• apache thrift Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path CVE-2026-58023 Fix available 6.9 MediumJuly 27, 2026
• apache thrift Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVE-2026-55971 Fix available 9.3 CriticalJuly 27, 2026
• apache thrift Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() CVE-2026-55970 Fix available 6.9 MediumJuly 27, 2026
• apache thrift Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() CVE-2026-55969 Fix available 8.7 HighJuly 27, 2026
• apache thrift Apache Thrift: Node.js quadratic-time DoS in server receive transports CVE-2026-55968 Fix available 8.7 HighJuly 27, 2026
• apache thrift Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb CVE-2026-49158 Fix available 7.5 HighJuly 27, 2026
• apache thrift Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit CVE-2026-48586 Fix available 8.7 HighJuly 27, 2026
• apache thrift Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass CVE-2026-48145 Fix available 8.2 HighJuly 27, 2026
• apache thrift Apache Thrift: c_glib TLS Client Missing Hostname Verification CVE-2026-48144 Fix available 9.1 CriticalJuly 27, 2026
• apache thrift Apache Thrift: Unbounded Read Leading to Denial of Service CVE-2026-45112 Fix available 6.9 MediumJuly 27, 2026
• apache thrift Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit CVE-2026-43871 Fix available 8.7 HighJuly 27, 2026
• apache thrift Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport CVE-2026-41608 Fix available 7.5 HighJuly 27, 2026
• apache thrift, red hat ai inference server, build of apache camel 3.33 for quarkus 3.33.2.sp1 +7 more +9 more Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern CVE-2026-43868 Fix available 5.3 MediumMay 5, 2026
• apache thrift Apache Thrift: Node.js web_server.js multi-vulnerability CVE-2026-43870 Fix available 7.3 HighMay 5, 2026
• apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +24 more +26 more Apache Thrift: TSSLTransportFactory.java hostname verification CVE-2026-43869 Fix available 7.3 HighMay 5, 2026
• apache thrift Apache Thrift: Node.js skip() recursion CVE-2026-41636 Fix available 8.7 HighApril 28, 2026
• apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 more Apache Thrift: C++ JSON OOB read CVE-2026-41607 Fix available 6.5 MediumApril 28, 2026
• apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 more Apache Thrift: c_glib dispatch stack overflow CVE-2026-41606 Fix available 5.3 MediumApril 28, 2026
• apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 more Apache Thrift: Swift Compact Protocol integer overflow CVE-2026-41605 Fix available 7.3 HighApril 28, 2026
• apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 more Apache Thrift: Swift Range crash in skip() CVE-2026-41604 Fix available 8.2 HighApril 28, 2026
• apache thrift, red hat multicluster global hub, multicluster global hub 1.3.4 +17 more +19 more Apache Thrift: Go TFramedTransport uint32 overflow CVE-2026-41602 Fix available 7.5 HighApril 28, 2026
• apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +16 more +18 more Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. CVE-2025-48431 Fix available 7.5 HighApril 28, 2026
• apache thrift, hive, oracle communications cloud native core network slice selection function +1 more +3 more Uncontrolled Resource Consumption in Apache Thrift CVE-2020-13949 Fix available 7.5 HighFebruary 12, 2021
• apache thrift, oracle communications cloud native core network slice selection function, redhat jboss enterprise application platform +2 more Loop with Unreachable Exit Condition in Apache Thrift CVE-2019-0205 Public exploitFix available 7.5 HighOctober 28, 2019
• apache thrift, oracle communications cloud native core network slice selection function, redhat jboss enterprise application platform +2 more Out-of-bounds read in Apache Thrift CVE-2019-0210 Fix available 7.5 HighOctober 28, 2019
• apache thrift Apache Thrift Node.js static web server sandbox escape CVE-2018-11798 Fix available 6.5 MediumJanuary 7, 2019
• apache thrift, debian linux, f5 traffix signaling delivery controller +2 more +4 more Improper Input Validation in Apache Thrift CVE-2018-1320 Fix available 7.5 HighJanuary 7, 2019
• apache thrift Apache Thrift Go Library Command Injection CVE-2016-5397 Fix available 8.8 HighFebruary 12, 2018
• apache thrift The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to... CVE-2015-3254 6.5 MediumJune 16, 2017