Most recent entries from all

BIT-thrift-2026-41636 — Apache Thrift: Node.js skip() recursion

Affected: Bitnami: thrift

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

certfr-2026-avi-0588 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0588

EUVD-2026-293246

fkie_cve-2026-41636

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

GHSA-r67j-r569-jrwp — Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion

Affected: npm: thrift

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

msrc_CVE-2026-41636 — Apache Thrift: Node.js skip() recursion

msrc_CVE-2026-41636

openSUSE-SU-2026:10685-1 — libthrift-0_23_0-0.23.0-1.1 on GA media

libthrift-0_23_0-0.23.0-1.1 on GA media

RHSA-2026:21769 — Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update

grafana/tempo: Tempo: Denial of Service via large queries net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via mal…

UBUNTU-CVE-2026-41636

Affected: Ubuntu:20.04:LTS: thrift, Ubuntu:22.04:LTS: thrift, Ubuntu:24.04:LTS: thrift, Ubuntu:25.10: thrift, Ubuntu:26.04:LTS: thrift

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

WID-SEC-W-2026-2076 — IBM App Connect Enterprise (Apache Thrift): Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, und um nicht näher spezifizierte Auswirkungen zu verursachen.