Apache thrift

This hub aggregates every CVE we track for Apache thrift, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache thrift.

• CVE-2026-66053Apache Thrift: Python TSSLSocket Hostname Matcher Import5.9Jul 27, 2026
• CVE-2026-58662Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass9.1Jul 27, 2026
• CVE-2026-58389Apache Thrift: Rust binary protocol non-strict path missing string size limit7.5Jul 27, 2026
• CVE-2026-58023Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path9.1Jul 27, 2026
• CVE-2026-55971Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()9.8Jul 27, 2026
• CVE-2026-55970Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()6.5Jul 27, 2026
• CVE-2026-55969Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()7.5Jul 27, 2026
• CVE-2026-55968Apache Thrift: Node.js quadratic-time DoS in server receive transports7.5Jul 27, 2026
• CVE-2026-49158Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb7.5Jul 27, 2026
• CVE-2026-48586Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit7.5Jul 27, 2026
• CVE-2026-48145Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass7.5Jul 27, 2026
• CVE-2026-48144Apache Thrift: c_glib TLS Client Missing Hostname Verification9.1Jul 27, 2026
• CVE-2026-45112Apache Thrift: Unbounded Read Leading to Denial of Service7.5Jul 27, 2026
• CVE-2026-43871Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit7.5Jul 27, 2026
• CVE-2026-41608Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport7.5Jul 27, 2026