CVE-2026-91137

Vulnerability involving allocation of resources without limits or throttling in Apache Thrift Erlang bindings. Lack of limits can lead to resource exhaustion. Affects versions before 0.25.0.

Vulnerability in Apache Thrift Java bindings involving improper handling of exceptional conditions and missing release of resources after effective lifetime. Affects versions before 0.25.0.

Uncontrolled recursion vulnerability in Apache Thrift c_glib bindings. Excessive recursion can lead to stack overflow and process crash. Affects versions before 0.25.0.

Vulnerability in Apache Thrift nodejs bindings involving improper validation of specified quantity in input and allocation of resources without limits. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. Lack of limits can lead to resource exhaustion. Affects versions before 0.25.0.

Uncaught exception vulnerability in Apache Thrift PHP bindings. An unhandled exception can lead to unexpected termination of the application. Affects versions before 0.25.0.

Vulnerability in Apache Thrift Dart bindings involving memory allocation with excessive size value and improper handling of length parameter inconsistency. Affects versions before 0.25.0.

Vulnerability in Apache Thrift THeaderTransport involving missing release of memory and resources after effective lifetime. Affects versions before 0.25.0.

A stack-based buffer overflow and incorrect bitwise shift of integer vulnerability exists in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift versions before 0.25.0.

Improper handling of length parameter inconsistency, uncaught exception, inefficient algorithmic complexity, memory allocation with excessive size value, and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift versions before 0.25.0.