Apache Thrift

Every one of the 93 is a mark on the map. Named now: 1 to 26, most at risk first.

1. In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been pa…CVE-2019-0205Apache · 9.2% likely

   CWE-835

2. Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An asser…CVE-2018-1320Apache Software Foundation · 8.2% likely

   CWE-295

3. The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and o…CVE-2016-5397Apache Software Foundation · 6.9% likely

   CWE-77

4. In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.CVE-2020-13949Apache · 6.9% likely

   CWE-400

5. In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.CVE-2019-0210Apache · 6.5% likely

   CWE-125

6. The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to acc…CVE-2018-11798Apache Software Foundation · 4.7% likely

   CWE-538

7. Apache Thrift: Go TFramedTransport uint32 overflowCVE-2026-41602Apache Software Foundation · CVSS 7.5 · 1.2% likely

   CWE-190

8. Apache Thrift: c_glib dispatch stack overflowCVE-2026-41606Apache Software Foundation · CVSS 5.3 · 1.1% likely

   CWE-674

9. Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassCVE-2026-58662Apache Software Foundation · CVSS 8.7 · 1.1% likely

   CWE-1284

10. Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.CVE-2025-48431Apache Software Foundation · CVSS 7.5 · 1.0% likely

    CWE-762

11. Apache Thrift: Rust binary protocol non-strict path missing string size limitCVE-2026-58389Apache Software Foundation · CVSS 8.7 · 1.0% likely

    CWE-770

12. Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()CVE-2026-55969Apache Software Foundation · CVSS 8.7 · 1.0% likely

    CWE-190

13. Apache Thrift: Node.js quadratic-time DoS in server receive transportsCVE-2026-55968Apache Software Foundation · CVSS 8.7 · 1.0% likely

    CWE-407

14. Apache Thrift: Ruby THeaderTransport ZLIB Decompression BombCVE-2026-49158Apache Software Foundation · CVSS 7.5 · 1.0% likely

    CWE-409

15. Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size LimitCVE-2026-48586Apache Software Foundation · CVSS 8.7 · 1.0% likely

    CWE-409

16. Apache Thrift: Unbounded Read Leading to Denial of ServiceCVE-2026-45112Apache Software Foundation · CVSS 6.9 · 1.0% likely

    CWE-770

17. Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limitCVE-2026-43871Apache Software Foundation · CVSS 8.7 · 1.0% likely

    CWE-835

18. Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransportCVE-2026-41608Apache Software Foundation · CVSS 7.5 · 1.0% likely

    CWE-409

19. Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes pathCVE-2026-58023Apache Software Foundation · CVSS 6.9 · 1.0% likely

    CWE-125

20. Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()CVE-2026-55971Apache Software Foundation · CVSS 9.3 · 1.0% likely

    CWE-122

21. Apache Thrift: Swift Compact Protocol integer overflowCVE-2026-41605Apache Software Foundation · CVSS 7.3 · 0.9% likely

    CWE-190

22. Apache Thrift: Swift Range crash in skip()CVE-2026-41604Apache Software Foundation · CVSS 8.2 · 0.9% likely

    CWE-125

23. Apache Thrift: C++ JSON OOB readCVE-2026-41607Apache Software Foundation · CVSS 6.5 · 0.9% likely

    CWE-125

24. Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()CVE-2026-55970Apache Software Foundation · CVSS 6.9 · 0.8% likely

    CWE-126

25. Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternCVE-2026-43868Apache Software Foundation · CVSS 5.3 · 0.7% likely

    CWE-789

26. Apache Thrift: TSSLTransportFactory.java hostname verificationCVE-2026-43869Apache Software Foundation · CVSS 7.3 · 0.6% likely

    CWE-297

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.