Apache product

Thrift

← All Apache products

No Thrift CVE is in the CISA KEV catalogue.

Tracked since 6 Oct · latest article Tue 6 Oct · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 0 in the full CISA catalogue · all time
High exploit odds · current: 0; EPSS top 5%, not in KEV
Articles · 7 days: 0; none this week

Exploited, by due date

CSV download

No Thrift CVE is in the CISA KEV catalogue.

Coverage

1 article · all timeFull timeline

One article so far, 6 Oct. A pattern appears once more outlets cover Thrift.

Tue 6 Oct · first reportApache Thrift fixes 61 flaws, including unauthenticated critical bugsSecurityOnline

All CVEs in coverage

CVE-2026-61373Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocationCVSS8.7High–Not in KEV0.4%EPSS1article

CVE-2026-63772Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform countCVSS8.7High–Not in KEV0.4%EPSS1article

CVE-2026-83632Apache Thrift: C++ THttpTransport grows its line buffer without boundCVSS9.2Critical–Not in KEV0.4%EPSS1article

CVE-2026-91135Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)CVSS9.2Critical–Not in KEV0.3%EPSS1article

CVE-2026-85088Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not matchCVSS6.9Medium–Not in KEV0.2%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

Thrift

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts