Most recent entries from all

BIT-thrift-2025-48431 — Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

Affected: Bitnami: thrift

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

certfr-2026-avi-0588 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0588

EUVD-2026-366117

fkie_cve-2025-48431

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

GHSA-ppv5-592p-g5q4

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

msrc_CVE-2025-48431 — Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

msrc_CVE-2025-48431

RHSA-2026:24539 — Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update

Apache Thrift: c_glib: Apache Thrift c_glib: Denial of Service via specially crafted requests github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input follow-redirects: follow-redirects: Information disclosure via cross-domain redirects github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion axios: Axios: HTTP Transport Hijacking via Prototype Pollution axios: Axios: Arbitrary HTTP header injection via prototype pollution axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling axios:…

UBUNTU-CVE-2025-48431

Affected: Ubuntu:20.04:LTS: thrift, Ubuntu:22.04:LTS: thrift, Ubuntu:24.04:LTS: thrift, Ubuntu:25.10: thrift, Ubuntu:26.04:LTS: thrift

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

WID-SEC-W-2026-3623 — IBM DataPower Gateway: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen, einen Denial-of-Service-Zustand auszulösen oder Cross-Site-Scripting-Angriffe durchzuführen.