{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Apache Software Foundation Apache Thrift: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apache-software-foundation--apache-thrift/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apache-software-foundation--apache-thrift/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66054/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66054/",
   "title": "CVE-2026-66054 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:58:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66054/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66054/",
   "title": "CVE-2026-66054 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:58:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-61374/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-61374/",
   "title": "CVE-2026-61374 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:53:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-63772/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-63772/",
   "title": "CVE-2026-63772 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:52:07Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-63772/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-63772/",
   "title": "CVE-2026-63772 · Apache Software Foundation Apache Thrift · fixed in Chainguard (milvus-2.5 2.5.27-r38 and 4 more)",
   "content_text": "Fixed versions: milvus-2.5 2.5.27-r38, milvus-2.6 2.6.25-r9, milvus-3.0 3.0.3-r4, opentelemetry-collector-contrib 0.163.0-r0, opentelemetry-collector-contrib-fips 0.163.0-r0.",
   "date_published": "2026-10-02T12:52:07Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-63772/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-63772/",
   "title": "CVE-2026-63772 · Apache Software Foundation Apache Thrift · fixed in Wolfi (opentelemetry-collector-contrib 0.163.0-r0)",
   "content_text": "Fixed versions: opentelemetry-collector-contrib 0.163.0-r0.",
   "date_published": "2026-10-02T12:52:07Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66055/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66055/",
   "title": "CVE-2026-66055 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:49:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66055/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66055/",
   "title": "CVE-2026-66055 · Apache Software Foundation Apache Thrift · fixed in Chainguard (milvus-2.5 2.5.27-r38 and 2 more)",
   "content_text": "Fixed versions: milvus-2.5 2.5.27-r38, milvus-2.6 2.6.25-r9, milvus-3.0 3.0.3-r4.",
   "date_published": "2026-10-02T12:49:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66055/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66055/",
   "title": "CVE-2026-66055 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:49:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66081/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66081/",
   "title": "CVE-2026-66081 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:33:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66081/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66081/",
   "title": "CVE-2026-66081 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:33:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66331/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66331/",
   "title": "CVE-2026-66331 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:32:46Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66331/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66331/",
   "title": "CVE-2026-66331 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:32:46Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66837/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66837/",
   "title": "CVE-2026-66837 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:29:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66837/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66837/",
   "title": "CVE-2026-66837 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:29:09Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66858/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66858/",
   "title": "CVE-2026-66858 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:27:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66858/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66858/",
   "title": "CVE-2026-66858 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:27:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66859/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66859/",
   "title": "CVE-2026-66859 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:23:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-66859/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-66859/",
   "title": "CVE-2026-66859 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:23:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83632/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83632/",
   "title": "CVE-2026-83632 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:22:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83663/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83663/",
   "title": "CVE-2026-83663 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncontrolled Recursion vulnerability in Apache Thrift go bindings.\n\n\n\nBoth Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:18:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83663/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83663/",
   "title": "CVE-2026-83663 · Apache Software Foundation Apache Thrift · fixed in Chainguard (milvus-2.5 2.5.27-r38 and 4 more)",
   "content_text": "Fixed versions: milvus-2.5 2.5.27-r38, milvus-2.6 2.6.25-r9, milvus-3.0 3.0.3-r4, opentelemetry-collector-contrib 0.163.0-r0, opentelemetry-collector-contrib-fips 0.163.0-r0.",
   "date_published": "2026-10-02T12:18:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83663/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83663/",
   "title": "CVE-2026-83663 · Apache Software Foundation Apache Thrift · fixed in Wolfi (opentelemetry-collector-contrib 0.163.0-r0)",
   "content_text": "Fixed versions: opentelemetry-collector-contrib 0.163.0-r0.",
   "date_published": "2026-10-02T12:18:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83745/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83745/",
   "title": "CVE-2026-83745 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift \nnodejs and D lang bindings.\n\nBoth bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.\n\n\n\n\nThis issue affects Apache Thrift before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:16:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-83745/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-83745/",
   "title": "CVE-2026-83745 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:16:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85476/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85476/",
   "title": "CVE-2026-85476 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:12:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96289/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96289/",
   "title": "CVE-2026-96289 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:07:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96289/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96289/",
   "title": "CVE-2026-96289 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T12:07:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96287/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96287/",
   "title": "CVE-2026-96287 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:05:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96287/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96287/",
   "title": "CVE-2026-96287 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T12:05:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96286/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96286/",
   "title": "CVE-2026-96286 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncaught exception vulnerability in Apache Thrift Perl bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:04:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96286/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96286/",
   "title": "CVE-2026-96286 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T12:04:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96277/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96277/",
   "title": "CVE-2026-96277 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:03:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96277/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96277/",
   "title": "CVE-2026-96277 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T12:03:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96277/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96277/",
   "title": "CVE-2026-96277 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:03:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94658/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94658/",
   "title": "CVE-2026-94658 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:02:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94658/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94658/",
   "title": "CVE-2026-94658 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T12:02:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94657/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94657/",
   "title": "CVE-2026-94657 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:01:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94657/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94657/",
   "title": "CVE-2026-94657 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T12:01:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94657/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94657/",
   "title": "CVE-2026-94657 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T12:01:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94656/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94656/",
   "title": "CVE-2026-94656 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T12:00:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94656/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94656/",
   "title": "CVE-2026-94656 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T12:00:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94655/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94655/",
   "title": "CVE-2026-94655 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:59:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94655/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94655/",
   "title": "CVE-2026-94655 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:59:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94654/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94654/",
   "title": "CVE-2026-94654 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:58:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94654/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94654/",
   "title": "CVE-2026-94654 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:58:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94654/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94654/",
   "title": "CVE-2026-94654 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:58:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94653/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94653/",
   "title": "CVE-2026-94653 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:56:35Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94653/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94653/",
   "title": "CVE-2026-94653 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:56:35Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94652/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94652/",
   "title": "CVE-2026-94652 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:54:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94652/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94652/",
   "title": "CVE-2026-94652 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:54:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94648/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94648/",
   "title": "CVE-2026-94648 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:52:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94646/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94646/",
   "title": "CVE-2026-94646 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:52:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94646/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94646/",
   "title": "CVE-2026-94646 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:52:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94638/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94638/",
   "title": "CVE-2026-94638 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:49:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94638/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94638/",
   "title": "CVE-2026-94638 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:49:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94637/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94637/",
   "title": "CVE-2026-94637 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:49:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94637/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94637/",
   "title": "CVE-2026-94637 · Apache Software Foundation Apache Thrift · fixed in Chainguard (milvus-2.5 2.5.27-r38 and 4 more)",
   "content_text": "Fixed versions: milvus-2.5 2.5.27-r38, milvus-2.6 2.6.25-r9, milvus-3.0 3.0.3-r4, opentelemetry-collector-contrib 0.163.0-r0, opentelemetry-collector-contrib-fips 0.163.0-r0.",
   "date_published": "2026-10-02T11:49:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94637/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94637/",
   "title": "CVE-2026-94637 · Apache Software Foundation Apache Thrift · fixed in Wolfi (opentelemetry-collector-contrib 0.163.0-r0)",
   "content_text": "Fixed versions: opentelemetry-collector-contrib 0.163.0-r0.",
   "date_published": "2026-10-02T11:49:02Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94636/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94636/",
   "title": "CVE-2026-94636 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:47:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92834/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92834/",
   "title": "CVE-2026-92834 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:45:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90440/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90440/",
   "title": "CVE-2026-90440 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:44:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90440/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90440/",
   "title": "CVE-2026-90440 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:44:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-87117/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-87117/",
   "title": "CVE-2026-87117 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "NULL pointer dereference vulnerability in Apache Thrift PHP bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:43:11Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86537/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86537/",
   "title": "CVE-2026-86537 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:40:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86537/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86537/",
   "title": "CVE-2026-86537 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:40:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86537/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86537/",
   "title": "CVE-2026-86537 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:40:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86536/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86536/",
   "title": "CVE-2026-86536 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.",
   "date_published": "2026-10-02T11:40:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86536/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86536/",
   "title": "CVE-2026-86536 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:40:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86535/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86535/",
   "title": "CVE-2026-86535 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:38:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86535/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86535/",
   "title": "CVE-2026-86535 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:38:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85088/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85088/",
   "title": "CVE-2026-85088 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.\n\n\n\nBoth libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the host\n\nname that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a \"skip\" result rather than\n\na rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check.\n\n\n\nRFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a\n\nCommon Name for another is therefore accepted for a connection to the second name.\n\n\n\nExploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client's trust store and whose Common Name matches the connected host\n\nname. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure.\n\n\n\nThis issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.",
   "date_published": "2026-10-02T11:37:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85088/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85088/",
   "title": "CVE-2026-85088 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:37:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85087/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85087/",
   "title": "CVE-2026-85087 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:35:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85086/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85086/",
   "title": "CVE-2026-85086 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:34:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85086/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85086/",
   "title": "CVE-2026-85086 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:34:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85086/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85086/",
   "title": "CVE-2026-85086 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:34:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82459/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82459/",
   "title": "CVE-2026-82459 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:32:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82459/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82459/",
   "title": "CVE-2026-82459 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:32:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82459/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82459/",
   "title": "CVE-2026-82459 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:32:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82458/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82458/",
   "title": "CVE-2026-82458 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings.\n\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:30:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82458/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82458/",
   "title": "CVE-2026-82458 · Apache Software Foundation Apache Thrift · fixed in Chainguard (milvus-2.5 2.5.27-r38 and 4 more)",
   "content_text": "Fixed versions: milvus-2.5 2.5.27-r38, milvus-2.6 2.6.25-r9, milvus-3.0 3.0.3-r4, opentelemetry-collector-contrib 0.163.0-r0, opentelemetry-collector-contrib-fips 0.163.0-r0.",
   "date_published": "2026-10-02T11:30:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82458/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82458/",
   "title": "CVE-2026-82458 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:30:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82458/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82458/",
   "title": "CVE-2026-82458 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:30:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-82458/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-82458/",
   "title": "CVE-2026-82458 · Apache Software Foundation Apache Thrift · fixed in Wolfi (opentelemetry-collector-contrib 0.163.0-r0)",
   "content_text": "Fixed versions: opentelemetry-collector-contrib 0.163.0-r0.",
   "date_published": "2026-10-02T11:30:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96288/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96288/",
   "title": "CVE-2026-96288 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:18:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96288/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96288/",
   "title": "CVE-2026-96288 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:18:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96292/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96292/",
   "title": "CVE-2026-96292 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:11:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96292/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96292/",
   "title": "CVE-2026-96292 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:11:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96292/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96292/",
   "title": "CVE-2026-96292 · Apache Software Foundation Apache Thrift · fixed in Red Hat hummingbird 1 (perl-thrift 0:0.25.0-0.1.hum1 and 5 more)",
   "content_text": "Fixed versions: perl-thrift 0:0.25.0-0.1.hum1, python3-thrift 0:0.25.0-0.1.hum1, thrift 0:0.25.0-0.1.hum1, thrift-devel 0:0.25.0-0.1.hum1, thrift-glib 0:0.25.0-0.1.hum1, thrift-qt 0:0.25.0-0.1.hum1.",
   "date_published": "2026-10-02T11:11:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96294/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96294/",
   "title": "CVE-2026-96294 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:09:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-61373/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-61373/",
   "title": "CVE-2026-61373 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:07:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96990/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96990/",
   "title": "CVE-2026-96990 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T11:00:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96990/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96990/",
   "title": "CVE-2026-96990 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T11:00:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94642/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94642/",
   "title": "CVE-2026-94642 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Uncaught exception vulnerability in Apache Thrift PHP bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T10:57:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94642/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94642/",
   "title": "CVE-2026-94642 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T10:57:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94644/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94644/",
   "title": "CVE-2026-94644 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T10:53:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94644/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94644/",
   "title": "CVE-2026-94644 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T10:53:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94645/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94645/",
   "title": "CVE-2026-94645 · Apache Software Foundation Apache Thrift · disclosed",
   "content_text": "Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.",
   "date_published": "2026-10-02T10:51:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94645/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94645/",
   "title": "CVE-2026-94645 · Apache Software Foundation Apache Thrift · fixed in openSUSE Tumbleweed (thrift 0.25.0-1.1)",
   "content_text": "Fixed versions: thrift 0.25.0-1.1.",
   "date_published": "2026-10-02T10:51:40Z"
  }
 ]
}