CVE Vulnerability Catalog

Apache Thrift JavaME bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.

Apache Thrift Ruby bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.

Apache Thrift Lua bindings before version 0.25.0 have allocation of resources without limits or throttling and inefficient algorithmic complexity vulnerabilities, which can lead to resource exhaustion and slowdown.

Infinite loop vulnerability in Apache Thrift Python bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.

Infinite loop vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.

Vulnerability in Apache Thrift nodejs and D language bindings due to improper handling of length parameter, leading to excessive memory allocation. A small frame can cause allocation of up to 2 GiB. Affects versions before 0.25.0.

Uncontrolled recursion vulnerability in Apache Thrift Go bindings. When a frame yields no payload, the transport reads the next frame and calls Read again, potentially exceeding the stack limit and crashing the process. Affects versions before 0.25.0.

NULL pointer dereference and use of uninitialized variable vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.

Vulnerability in the protocol skip routine in several Apache Thrift bindings that does not apply the recursion limit, allowing deep nesting of unknown fields to exhaust the stack. Affects Python C++ accelerator, PHP, Perl, Lua, Smalltalk, and OCaml libraries. Affects versions before 0.25.0.

Stack-based buffer overflow and integer overflow vulnerability in Apache Thrift PHP bindings. Affects versions before 0.25.0.

Access of uninitialized pointer vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python, and Delphi bindings. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift Go bindings. Affects versions before 0.25.0.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.