Maven package
org.apache.thrift/libthrift
pkg:maven/org.apache.thrift/libthrift
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-43869 | Hig | 7.3 | <= 0.22.0 | — | May 5, 2026 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. | |
| CVE-2020-13949 | — | >= 0.9.3, < 0.14.0 | 0.14.0 | Feb 12, 2021 | In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. | ||
| CVE-2019-0205 | — | < 0.13.0 | 0.13.0 | Oct 28, 2019 | In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language | ||
| CVE-2018-1320 | — | >= 0.5.0, < 0.9.3-1 | 0.9.3-1 | Jan 7, 2019 | Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production | ||
| CVE-2018-11798 | — | >= 0.9.2, < 0.12.0 | 0.12.0 | Jan 7, 2019 | The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path. |
- affected <= 0.22.0
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
- CVE-2020-13949Feb 12, 2021affected >= 0.9.3, < 0.14.0fixed 0.14.0
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
- CVE-2019-0205Oct 28, 2019affected < 0.13.0fixed 0.13.0
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language
- CVE-2018-1320Jan 7, 2019affected >= 0.5.0, < 0.9.3-1fixed 0.9.3-1
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production
- CVE-2018-11798Jan 7, 2019affected >= 0.9.2, < 0.12.0fixed 0.12.0
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.