Known vulnerabilities in Thrift

Known vulnerabilities in Thrift

Vendor: Apache Foundation

Software: Thrift

Software CPE: cpe:2.3:a:apache_foundation:thrift:*:*:*:*:*:*:*:*

Website: https://www.apache.org

Total vulnerabilities: 15

Public exploits: 0

Known exploited (KEV): 0

Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Vulnerabilities (15)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU128310 - Mismatched Memory Management Routines CVE-2025-48431	CWE-762	Medium	No	No	0.23.0	28.04.2026	SB2026042851
#VU128309 - Integer overflow CVE-2026-41602	CWE-190	Medium	No	No	0.23.0	28.04.2026	SB2026042851 SB2026051810
#VU128308 - Improper Validation of Certificate with Host Mismatch CVE-2026-41603	CWE-297	Medium	No	No	0.23.0	28.04.2026	SB2026042851 SB2026051810
#VU128307 - Out-of-bounds read CVE-2026-41604	CWE-125	Medium	No	No	0.23.0	28.04.2026	SB2026042851 SB2026051810
#VU128306 - Integer overflow CVE-2026-41605	CWE-190	Medium	No	No	0.23.0	28.04.2026	SB2026042851 SB2026051810
#VU128305 - Uncontrolled Recursion CVE-2026-41606	CWE-674	Medium	No	No	0.23.0	28.04.2026	SB2026042851 SB2026051810
#VU128304 - Out-of-bounds read CVE-2026-41607	CWE-125	Medium	No	No	0.23.0	28.04.2026	SB2026042851 SB2026051810
#VU128303 - Uncontrolled Recursion CVE-2026-41636	CWE-674	Medium	No	No	0.23.0	28.04.2026	SB2026042851 SB2026051810
#VU50684 - Improper input validation CVE-2020-13949	CWE-20	Medium	No	No	0.14.0	15.02.2021	SB2021021505 SB2021022701 SB2021030911 and 12 more
#VU26051 - Loop with Unreachable Exit Condition ('Infinite Loop') CVE-2015-3254	CWE-835	Medium	No	No	0.9.3	12.03.2020	SB2017061705
#VU26050 - Improper input validation CVE-2019-0210	CWE-20	Medium	No	No	0.12.0	12.03.2020	SB2019102916 SB2020031305 SB2021071503 and 4 more
#VU22565 - Loop with Unreachable Exit Condition ('Infinite Loop') CVE-2019-0205	CWE-835	Medium	No	No	0.13.0	06.11.2019	SB2019102916 SB2020031305 SB2021071503 and 11 more
#VU16954 - Exposure of sensitive information to an unauthorized actor CVE-2018-1320	CWE-200	Low	No	No	0.12.0	13.01.2019	SB2019011106 SB2019080913 SB2022041520 and 4 more
#VU16947 - Exposure of sensitive information to an unauthorized actor CVE-2018-11798	CWE-200	Low	No	No	0.12.0	11.01.2019	SB2019011106 SB2019102004 SB2022041520 and 1 more
#VU11178 - Command injection CVE-2016-5397	CWE-77	High	No	No	-	20.03.2018	-