Sylwester Lachiewicz

Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back

Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound

Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception

Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`

Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame

Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound