CVE-20XX-?

Apache Thrift CVEs.

Published CVEs affecting Apache Thrift, ranked by exploit odds.

25 CVEs · updated 2026-11-06 06:52 UTC

  1. CVE-2026-41602

    Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Memory safety Server Apache Thrift

    7.5 HIGH 1% exploit odds Fix listed
  2. CVE-2026-41606

    Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Denial of service Server Apache Thrift

    5.3 MEDIUM 1% exploit odds Fix listed
  3. CVE-2026-58662

    Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Memory safety Server Apache Thrift

    8.7 HIGH 1% exploit odds Fix listed
  4. CVE-2025-48431

    Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

    Denial of service Server Apache Thrift

    7.5 HIGH 1% exploit odds Fix listed
  5. CVE-2026-41608

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Other Server Apache Thrift

    7.5 HIGH 1% exploit odds Fix listed
  6. CVE-2026-43871

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Denial of service Web app Apache Thrift

    8.7 HIGH 1% exploit odds Fix listed
  7. CVE-2026-45112

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Denial of service Server Apache Thrift

    6.9 MEDIUM 1% exploit odds Fix listed
  8. CVE-2026-48586

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Other Server Apache Thrift

    8.7 HIGH 1% exploit odds Fix listed
  9. CVE-2026-49158

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Other Server Apache Thrift

    7.5 HIGH 1% exploit odds Fix listed
  10. CVE-2026-55968

    Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Other Server Apache Thrift

    8.7 HIGH 1% exploit odds Fix listed
  11. CVE-2026-55969

    Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Memory safety Server Apache Thrift

    8.7 HIGH 1% exploit odds Fix listed
  12. CVE-2026-58389

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Denial of service Server Apache Thrift

    8.7 HIGH 1% exploit odds Fix listed
  13. CVE-2026-58023

    Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Memory safety Server Apache Thrift

    6.9 MEDIUM 1% exploit odds Fix listed
  14. CVE-2026-55971

    Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Memory safety Server Apache Thrift

    9.3 CRITICAL 1.0% exploit odds Fix listed
  15. CVE-2026-41605

    Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Memory safety Server Apache Thrift

    7.3 HIGH 0.9% exploit odds Fix listed
  16. CVE-2026-41604

    Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Memory safety Server Apache Thrift

    8.2 HIGH 0.9% exploit odds Fix listed
  17. CVE-2026-41607

    Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Memory safety Server Apache Thrift

    6.5 MEDIUM 0.9% exploit odds Fix listed
  18. CVE-2026-55970

    Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Other Server Apache Thrift

    6.9 MEDIUM 0.8% exploit odds Fix listed
  19. CVE-2026-43868

    Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Other Server Apache Thrift

    5.3 MEDIUM 0.7% exploit odds Fix listed
  20. CVE-2026-43869

    Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Other Server Apache Thrift

    7.3 HIGH 0.6% exploit odds Fix listed
  21. CVE-2026-41636

    Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Denial of service Server Apache Thrift

    8.7 HIGH 0.5% exploit odds Fix listed
  22. CVE-2026-48145

    Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Other Server Apache Thrift

    8.2 HIGH 0.4% exploit odds Fix listed
  23. CVE-2026-48144

    Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

    Other Server Apache Thrift

    9.1 CRITICAL 0.4% exploit odds Fix listed
  24. CVE-2026-43870

    Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

    Disclosure Server Apache Thrift

    7.3 HIGH 0.4% exploit odds Fix listed
  25. CVE-2026-66053

    Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603

    Other Server Apache Thrift

    5.9 MEDIUM 0.3% exploit odds Fix listed

All CVEs affecting Apache Thrift that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.