azure linux thrift vulnerabilities

Latest azure linux thrift CVEs

Newest publication first · page 1 of 3

1. CVE-2026-66054 Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

   Published 2026-10-02

   Medium·CVSS 6.9 EPSS 0.28%

   Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the...

2. CVE-2026-63772 Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.32%

   Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

3. CVE-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

   Published 2026-10-02

   High·CVSS 8.2 EPSS 0.28%

   Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

4. CVE-2026-66081 Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.32%

   Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

5. CVE-2026-66331 Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize

   Published 2026-10-02

   Medium·CVSS 6.9 EPSS 0.28%

   Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

6. CVE-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.35%

   Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

7. CVE-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.31%

   The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library...

8. CVE-2026-66859 Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.32%

   NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

9. CVE-2026-83632 Apache Thrift: C++ THttpTransport grows its line buffer without bound

   Published 2026-10-02

   Critical·CVSS 9.2 EPSS 0.30%

   Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

10. CVE-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

    Published 2026-10-02

    High·CVSS 8.7 EPSS 0.34%

    Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes imme...

11. CVE-2026-85476 Apache Thrift: c_glib `read_all` spins when the underlying read returns 0

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.33%

    Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

12. CVE-2026-96287 Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.34%

    Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

13. CVE-2026-96286 Apache Thrift: Perl servers end `serve()` when serving one connection fails

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.34%

    Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

14. CVE-2026-96277 Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

    Published 2026-10-02

    High·CVSS 8.7 EPSS 0.34%

    Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

15. CVE-2026-94656 Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.34%

    Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

16. CVE-2026-94654 Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.33%

    Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

17. CVE-2026-94652 Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back

    Published 2026-10-02

    Medium·CVSS 6.3 EPSS 0.28%

    Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

18. CVE-2026-94636 Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.28%

    Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommen...

19. CVE-2026-92834 Apache Thrift: C++ WebSocket server transport does not read a full request length

    Published 2026-10-02

    Medium·CVSS 6.3 EPSS 0.28%

    Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

20. CVE-2026-85088 Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

    Published 2026-10-02

    Medium·CVSS 6.9 EPSS 0.17%

    Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certific...

21. CVE-2026-85087 Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

    Published 2026-10-02

    Medium·CVSS 6.9 EPSS 0.15%

    Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

22. CVE-2026-82459 Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.34%

    Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

23. CVE-2026-82458 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes a...

    Published 2026-10-02

    High·CVSS 8.7 EPSS 0.34%

    Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommen...

24. CVE-2026-94650 Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)

    Published 2026-10-02

    High·CVSS 8.2 EPSS 0.30%

    Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

25. CVE-2026-85483 Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end

    Published 2026-10-02

    Medium·CVSS 6.3 EPSS 0.34%

    Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.