Apache Thrift vulnerabilities

Improper validation of specified quantity in input and out-of-bounds read in Apache Thrift C++ bindings. Affects versions before 0.24.0.

A vulnerability in Apache Thrift c_glib bindings before version 0.24.0 causes an out-of-bounds read, potentially leading to data disclosure or crash.

Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.

Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.

A vulnerability in Apache Thrift Python bindings before version 0.24.0 involves improper validation of certificate with host mismatch, enabling man-in-the-middle attacks.

Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.

A vulnerability in Apache Thrift C++ bindings before version 0.24.0 causes a buffer over-read, potentially leading to data disclosure or crash.

Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.

Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. Affects versions before 0.24.0.

Improper validation of certificate with host mismatch in Apache Thrift C++ bindings. Affects versions before 0.24.0.

A vulnerability in Apache Thrift Java bindings from version 0.19.0 before 0.24.0 involves allocation of resources without limits or throttling, potentially leading to resource exhaustion (DoS).

An infinite loop vulnerability exists in Apache Thrift Python, Go, PHP and Java bindings. The issue affects versions before 0.24.0.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This affects Apache Thrift before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Vulnerability in Apache Thrift involving memory allocation with excessive size. Affects versions before 0.23.0.

Apache Thrift before version 0.23.0 improperly validates TLS certificates, allowing host mismatch. An attacker can exploit this for man-in-the-middle attacks.

An out-of-bounds read vulnerability has been identified in Apache Thrift before version 0.23.0. The issue is fixed in version 0.23.0.

In Apache Thrift before version 0.23.0, an uncontrolled recursion vulnerability was found that could lead to denial of service. The issue is fixed in version 0.23.0.

Apache Thrift before version 0.23.0 contains an integer overflow or wraparound vulnerability. The issue is fixed in version 0.23.0.

Apache Thrift before version 0.23.0 contains an out-of-bounds read vulnerability. The issue is fixed in version 0.23.0.

An integer overflow or wraparound vulnerability has been identified in the Go language implementation of TFramedTransport in Apache Thrift before version 0.23.0. This can lead to unexpected behavior or potential remote code execution.

Mismatched memory management routines in Apache Thrift c_glib language bindings can crash a Thrift server with a 'free(): invalid pointer' error when processing a specially crafted request.