Apache Thrift vulnerabilities

32 CVEs affecting Apache Thrift, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-66053, published 2026-07-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0205, published 2019-10-29. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in…
CVE-2018-1320, published 2019-01-07. High severity, CVSS 7.5. EPSS: 8.2% chance of exploitation in the next 30 days. Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine…
CVE-2016-5397, published 2018-02-12. High severity, CVSS 8.8. EPSS: 6.9% chance of exploitation in the next 30 days. The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in…
CVE-2020-13949, published 2021-02-12. High severity, CVSS 7.5. EPSS: 6.8% chance of exploitation in the next 30 days. In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
CVE-2019-0210, published 2019-10-29. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
CVE-2015-3254, published 2017-06-16. Medium severity, CVSS 6.5. EPSS: 5.3% chance of exploitation in the next 30 days. The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
CVE-2018-11798, published 2019-01-07. Medium severity, CVSS 6.5. EPSS: 4.9% chance of exploitation in the next 30 days. The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside…
CVE-2026-41605, published 2026-04-28. High severity, CVSS 7.3. EPSS: 1.3% chance of exploitation in the next 30 days. Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
CVE-2026-43868, published 2026-05-05. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the…
CVE-2026-41604, published 2026-04-28. High severity, CVSS 8.2. EPSS: 1.2% chance of exploitation in the next 30 days. Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Latest

CVE-2026-66053, published 2026-07-27. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version…
CVE-2026-58662, published 2026-07-27. Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days. Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade…
CVE-2026-58389, published 2026-07-27. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version…
CVE-2026-58023, published 2026-07-27. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
CVE-2026-55971, published 2026-07-27. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
CVE-2026-55970, published 2026-07-27. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
CVE-2026-55969, published 2026-07-27. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to…
CVE-2026-55968, published 2026-07-27. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are…
CVE-2026-49158, published 2026-07-27. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to…
CVE-2026-48586, published 2026-07-27. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are…