Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/apache/thrift

6 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 4 high
Registry
pkg.go.dev

Advisories 6

  • Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in…

    Affected: fixed in 0.24.0.

  • Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

    Affected: fixed in 0.24.0.

  • Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

    Affected: fixed in 0.24.0; fixed in 0.24.0.

  • Apache Thrift: Go TFramedTransport uint32 overflow

    Affected: fixed in 0.23.0.

  • In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid…

    Affected: from 0.0.0-20151001171628-53dd39833a08, fixed in 0.13.0; from 0.9.3, fixed in 0.13.0.

  • The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting…

    Affected: fixed in 0.10.0.