Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 95

Export CSV
CVE-2026-43869

Apache Thrift: TSSLTransportFactory.java hostname verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-43868

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-43870

Apache Thrift: Node.js web_server.js multi-vulnerability

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-41602

Apache Thrift: Go TFramedTransport uint32 overflow

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-41605

Apache Thrift: Swift Compact Protocol integer overflow

Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-41606

Apache Thrift: c_glib dispatch stack overflow

Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-41607

Apache Thrift: C++ JSON OOB read

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-41636

Apache Thrift: Node.js skip() recursion

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2015-3254

thrift: Infinite recursion via vectors involving the skip function

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.

CVSS 3.0 · 6.5 Medium EPSS 5.3% KEV · Not listed
Vendors
Apache Redhat
Products
Thrift Jboss Amq Jboss Data Virtualization and 1 more
CVE-2019-0205

thrift: Endless loop when feed with specific input data

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

CVSS 3.1 · 7.5 High EPSS 9.2% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Thrift Communications Cloud Native Core Network Slice Selection Function Enterprise Linux Server and 6 more
CVE-2018-1320

thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

CVSS 3.1 · 7.5 High EPSS 8.2% KEV · Not listed
Vendors
Apache Debian F5 and 2 more
Products
Thrift Debian Linux Traffix Signaling Delivery Controller and 3 more
CVE-2018-11798

thrift: Improper Access Control grants access to files outside the webservers docroot path

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

CVSS 3.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Apache Redhat
Products
Thrift Jboss Data Virtualization Jboss Fuse
CVE-2016-5397

thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

CVSS 3.0 · 8.8 High EPSS 6.9% KEV · Not listed
Vendors
Apache Redhat
Products
Thrift Jboss Data Virtualization Jboss Fuse