CVE-2020-13949
Fixed in a distro release EPSS 7%
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
Products: apache hive, apache thrift, oracle communications_cloud_native_core_network_slice_selection_function, oracle communications_cloud_native_core_policy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.thrift:libthrift | 0.14.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | thrift | 0.14.0-1 |
| Chainguard | automq | no fix |
| Chainguard | automq | 1.7.4-r1 |
| Chainguard | automq-fips | no fix |
| Chainguard | automq-fips | 1.7.4-r1 |
| Chainguard | druid | no fix |
| Chainguard | druid | 34.0.0-r6 |
| Chainguard | spark-3.5-scala-2.12 | no fix |
| Chainguard | spark-3.5-scala-2.13 | no fix |
| Chainguard | spark-fips-3.5-scala-2.12 | no fix |
| Chainguard | spark-fips-3.5-scala-2.13 | no fix |
| Chainguard | trino | 440-r0 |
| Chainguard | trino-config | 440-r0 |
| Chainguard | trino-oci-entrypoint | 440-r0 |
| Chainguard | trino-plugin-ai-functions | 440-r0 |
| Chainguard | trino-plugin-bigquery | 440-r0 |
| Chainguard | trino-plugin-blackhole | 440-r0 |
| Chainguard | trino-plugin-cassandra | 440-r0 |
| Chainguard | trino-plugin-clickhouse | 440-r0 |
| Chainguard | trino-plugin-delta-lake | 440-r0 |
| Chainguard | trino-plugin-druid | 440-r0 |
| Chainguard | trino-plugin-duckdb | 440-r0 |
| Chainguard | trino-plugin-elasticsearch | 440-r0 |
| Chainguard | trino-plugin-exasol | 440-r0 |
| Chainguard | trino-plugin-exchange-filesystem | 440-r0 |
| Chainguard | trino-plugin-exchange-hdfs | 440-r0 |
| Chainguard | trino-plugin-faker | 440-r0 |
| Chainguard | trino-plugin-functions-python | 440-r0 |
| Chainguard | trino-plugin-geospatial | 440-r0 |
| Chainguard | trino-plugin-google-sheets | 440-r0 |
| Chainguard | trino-plugin-hive | 440-r0 |
| Chainguard | trino-plugin-http-event-listener | 440-r0 |
| Chainguard | trino-plugin-http-server-event-listener | 440-r0 |
| Chainguard | trino-plugin-hudi | 440-r0 |
| Chainguard | trino-plugin-iceberg | 440-r0 |
| Chainguard | trino-plugin-ignite | 440-r0 |
| Chainguard | trino-plugin-jmx | 440-r0 |
| Chainguard | trino-plugin-kafka | 440-r0 |
| Chainguard | trino-plugin-kafka-event-listener | 440-r0 |
| Chainguard | trino-plugin-lakehouse | 440-r0 |
| Chainguard | trino-plugin-ldap-group-provider | 440-r0 |
| Chainguard | trino-plugin-loki | 440-r0 |
| Chainguard | trino-plugin-mariadb | 440-r0 |
| Chainguard | trino-plugin-memory | 440-r0 |
| Chainguard | trino-plugin-ml | 440-r0 |
| Chainguard | trino-plugin-mongodb | 440-r0 |
| Chainguard | trino-plugin-mysql | 440-r0 |
| Chainguard | trino-plugin-mysql-event-listener | 440-r0 |
| Chainguard | trino-plugin-opa | 440-r0 |
| Chainguard | trino-plugin-openlineage | 440-r0 |
| Chainguard | trino-plugin-opensearch | 440-r0 |
| Chainguard | trino-plugin-oracle | 440-r0 |
| Chainguard | trino-plugin-password-authenticators | 440-r0 |
| Chainguard | trino-plugin-pinot | 440-r0 |
| Chainguard | trino-plugin-postgresql | 440-r0 |
| Chainguard | trino-plugin-prometheus | 440-r0 |
| Chainguard | trino-plugin-ranger | 440-r0 |
| Chainguard | trino-plugin-redis | 440-r0 |
| Chainguard | trino-plugin-redshift | 440-r0 |
| Chainguard | trino-plugin-resource-group-managers | 440-r0 |
| Chainguard | trino-plugin-session-property-managers | 440-r0 |
| Chainguard | trino-plugin-singlestore | 440-r0 |
| Chainguard | trino-plugin-snowflake | 440-r0 |
| Chainguard | trino-plugin-spooling-filesystem | 440-r0 |
| Chainguard | trino-plugin-sqlserver | 440-r0 |
| Chainguard | trino-plugin-teradata-functions | 440-r0 |
| Chainguard | trino-plugin-thrift | 440-r0 |
| Chainguard | trino-plugin-tpcds | 440-r0 |
| Chainguard | trino-plugin-tpch | 440-r0 |
| Chainguard | trino-plugin-vertica | 440-r0 |
| Debian 12 | thrift | 0.16.0-3 |
| Debian 13 | thrift | 0.16.0-3 |
| Debian 14 | thrift | 0.16.0-3 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-glassfish-el | 0:3.0.1-4.b08_redhat_00005.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-glassfish-el-impl | 0:3.0.1-4.b08_redhat_00005.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-hibernate | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-hibernate-core | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-hibernate-entitymanager | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-hibernate-envers | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-hibernate-infinispan | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-hibernate-java8 | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-jackson-databind | 0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-jboss-ejb-client | 0:4.0.12-1.Final_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-netty | 0:4.1.63-2.Final_redhat_00003.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-netty-all | 0:4.1.63-2.Final_redhat_00003.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-undertow | 0:1.4.18-16.SP14_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly | 0:7.1.11-4.GA_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-elytron | 0:1.1.14-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-http-client | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-http-client-common | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-http-ejb-client | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-http-naming-client | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-http-transaction-client | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-modules | 0:7.1.11-4.GA_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-naming-client | 0:1.0.13-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-openssl | 0:1.0.12-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-openssl-java | 0:1.0.12-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-openssl-linux | 0:1.0.12-6.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-openssl-linux-debuginfo | 0:1.0.12-6.Final_redhat_00001.1.ep7.el7 |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 25.10 | thrift | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | thrift | no fix |
| Wolfi | druid | 34.0.0-r6 |
| Wolfi | druid | no fix |
| Wolfi | trino | 440-r0 |
| Wolfi | trino-config | 440-r0 |
| Wolfi | trino-oci-entrypoint | 440-r0 |
| Wolfi | trino-plugin-ai-functions | 440-r0 |
| Wolfi | trino-plugin-bigquery | 440-r0 |
| Wolfi | trino-plugin-blackhole | 440-r0 |
| Wolfi | trino-plugin-cassandra | 440-r0 |
| Wolfi | trino-plugin-clickhouse | 440-r0 |
| Wolfi | trino-plugin-delta-lake | 440-r0 |
| Wolfi | trino-plugin-druid | 440-r0 |
| Wolfi | trino-plugin-duckdb | 440-r0 |
| Wolfi | trino-plugin-elasticsearch | 440-r0 |
| Wolfi | trino-plugin-exasol | 440-r0 |
| Wolfi | trino-plugin-exchange-filesystem | 440-r0 |
| Wolfi | trino-plugin-exchange-hdfs | 440-r0 |
| Wolfi | trino-plugin-faker | 440-r0 |
| Wolfi | trino-plugin-functions-python | 440-r0 |
| Wolfi | trino-plugin-geospatial | 440-r0 |
| Wolfi | trino-plugin-google-sheets | 440-r0 |
| Wolfi | trino-plugin-hive | 440-r0 |
| Wolfi | trino-plugin-http-event-listener | 440-r0 |
| Wolfi | trino-plugin-http-server-event-listener | 440-r0 |
| Wolfi | trino-plugin-hudi | 440-r0 |
| Wolfi | trino-plugin-iceberg | 440-r0 |
| Wolfi | trino-plugin-ignite | 440-r0 |
| Wolfi | trino-plugin-jmx | 440-r0 |
| Wolfi | trino-plugin-kafka | 440-r0 |
| Wolfi | trino-plugin-kafka-event-listener | 440-r0 |
| Wolfi | trino-plugin-lakehouse | 440-r0 |
| Wolfi | trino-plugin-ldap-group-provider | 440-r0 |
| Wolfi | trino-plugin-loki | 440-r0 |
| Wolfi | trino-plugin-mariadb | 440-r0 |
| Wolfi | trino-plugin-memory | 440-r0 |
| Wolfi | trino-plugin-ml | 440-r0 |
| Wolfi | trino-plugin-mongodb | 440-r0 |
| Wolfi | trino-plugin-mysql | 440-r0 |
| Wolfi | trino-plugin-mysql-event-listener | 440-r0 |
| Wolfi | trino-plugin-opa | 440-r0 |
| Wolfi | trino-plugin-openlineage | 440-r0 |
| Wolfi | trino-plugin-opensearch | 440-r0 |
| Wolfi | trino-plugin-oracle | 440-r0 |
| Wolfi | trino-plugin-password-authenticators | 440-r0 |
| Wolfi | trino-plugin-pinot | 440-r0 |
| Wolfi | trino-plugin-postgresql | 440-r0 |
| Wolfi | trino-plugin-prometheus | 440-r0 |
| Wolfi | trino-plugin-ranger | 440-r0 |
| Wolfi | trino-plugin-redis | 440-r0 |
| Wolfi | trino-plugin-redshift | 440-r0 |
| Wolfi | trino-plugin-resource-group-managers | 440-r0 |
| Wolfi | trino-plugin-session-property-managers | 440-r0 |
| Wolfi | trino-plugin-singlestore | 440-r0 |
| Wolfi | trino-plugin-snowflake | 440-r0 |
| Wolfi | trino-plugin-spooling-filesystem | 440-r0 |
| Wolfi | trino-plugin-sqlserver | 440-r0 |
| Wolfi | trino-plugin-teradata-functions | 440-r0 |
| Wolfi | trino-plugin-thrift | 440-r0 |
| Wolfi | trino-plugin-tpcds | 440-r0 |
| Wolfi | trino-plugin-tpch | 440-r0 |
| Wolfi | trino-plugin-vertica | 440-r0 |
| openSUSE Tumbleweed | thrift | 0.14.1-1.6 |