Apache Thrift vulnerabilities

Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.

Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.

Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.

NULL pointer dereference and use of uninitialized variable vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.

Vulnerability in the protocol skip routine in several Apache Thrift bindings that does not apply the recursion limit, allowing deep nesting of unknown fields to exhaust the stack. Affects Python C++ accelerator, PHP, Perl, Lua, Smalltalk, and OCaml libraries. Affects versions before 0.25.0.

Stack-based buffer overflow and integer overflow vulnerability in Apache Thrift PHP bindings. Affects versions before 0.25.0.

Access of uninitialized pointer vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift C++ WebSocket server (versions before 0.25.0) contains a use of uninitialized resource and return of wrong status code vulnerability. This can lead to unpredictable application behavior.

Uncaught exception, improper handling of exceptional conditions, and improper resource shutdown in Apache Thrift D TNonblockingServer. Affects versions before 0.25.0.

Uncaught exception, infinite loop, and integer underflow in Apache Thrift D language bindings. Affects versions before 0.25.0.

Uncontrolled recursion vulnerability in Apache Thrift c_glib bindings. Excessive recursion can lead to stack overflow and process crash. Affects versions before 0.25.0.

Vulnerability in Apache Thrift Dart bindings involving memory allocation with excessive size value and improper handling of length parameter inconsistency. Affects versions before 0.25.0.

Vulnerability in Apache Thrift THeaderTransport involving missing release of memory and resources after effective lifetime. Affects versions before 0.25.0.

A stack-based buffer overflow and incorrect bitwise shift of integer vulnerability exists in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift versions before 0.25.0.

Improper validation of specified quantity in input, allocation of resources without limits or throttling, and excessive iteration vulnerability exists in Apache Thrift PHP bindings. This issue affects Apache Thrift versions before 0.25.0.

An uncontrolled recursion vulnerability exists in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift versions before 0.25.0.

The c_glib bindings of Apache Thrift are vulnerable to use of uninitialized resource and return of wrong status code. This issue affects Apache Thrift before 0.25.0.

Allocation of resources without limits or throttling and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python bindings. This issue affects Apache Thrift versions before 0.25.0.

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer, and for large frames it also reads past the end of the transform buffer.

Improper validation of specified quantity in input and out-of-bounds read in Apache Thrift C++ bindings. Affects versions before 0.24.0.

A vulnerability in Apache Thrift c_glib bindings before version 0.24.0 causes an out-of-bounds read, potentially leading to data disclosure or crash.

Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.

Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.

Apache Thrift Perl bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive CPU or memory consumption.

Apache Thrift Lua bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive resource consumption.

Apache Thrift JavaME bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.

Apache Thrift Ruby bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.

Apache Thrift Lua bindings before version 0.25.0 have allocation of resources without limits or throttling and inefficient algorithmic complexity vulnerabilities, which can lead to resource exhaustion and slowdown.

Infinite loop vulnerability in Apache Thrift Python bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.

Infinite loop vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.

Vulnerability in Apache Thrift nodejs and D language bindings due to improper handling of length parameter, leading to excessive memory allocation. A small frame can cause allocation of up to 2 GiB. Affects versions before 0.25.0.

Uncontrolled recursion vulnerability in Apache Thrift Go bindings. When a frame yields no payload, the transport reads the next frame and calls Read again, potentially exceeding the stack limit and crashing the process. Affects versions before 0.25.0.

A resource allocation without limits or throttling vulnerability in Apache Thrift Delphi bindings buffered transport may lead to resource exhaustion. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python, and Delphi bindings. Affects versions before 0.25.0.

A vulnerability in Apache Thrift C++ bindings involves allocation of resources without limits or throttling and improper handling of highly compressed data (data amplification). Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift Go bindings. Affects versions before 0.25.0.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift C++ bindings (versions before 0.25.0) contain a missing release of memory after effective lifetime vulnerability. This can lead to gradual memory resource exhaustion.

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift PHP bindings (versions before 0.25.0) contain an allocation of resources without limits or throttling vulnerability. This can lead to server resource exhaustion.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

NULL pointer dereference vulnerability in Apache Thrift PHP bindings. Affects versions before 0.25.0.

All Apache Thrift JS bindings (versions before 0.25.0) are vulnerable to prototype pollution through improperly controlled modification of object prototype attributes. This can lead to unexpected JavaScript application behavior.