redhat/libthrift vulnerabilities

Latest redhat/libthrift CVEs

Newest publication first

1. CVE-2026-61373 Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.43%

   Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

2. CVE-2026-55971 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

   Published 2026-07-27

   Critical·CVSS 9.3 EPSS 0.98%

   Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

3. CVE-2026-48586 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

   Published 2026-07-27

   High·CVSS 8.7 EPSS 1.0%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

4. CVE-2026-45112 Apache Thrift: Unbounded Read Leading to Denial of Service

   Published 2026-07-27

   Medium·CVSS 6.9 EPSS 1.0%

   Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

5. CVE-2026-43868 Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

   Published 2026-05-05

   High·CVSS 7.5 EPSS 0.71%

   Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

6. CVE-2026-43870 Apache Thrift: Node.js web_server.js multi-vulnerability

   Published 2026-05-05

   High·CVSS 7.3 EPSS 0.38%

   Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue aff...

7. CVE-2026-43869 Apache Thrift: TSSLTransportFactory.java hostname verification

   Published 2026-05-05

   High·CVSS 7.3 EPSS 0.63%

   Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.