# github.com/apache/thrift (Go) vulnerabilities

6 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v0.25.0 (Sep 24, 2026): no advisory affects it
- Newest unaffected release: v0.25.0 (Sep 24, 2026), the latest release
- Releases: 17 since v0.12.0 (Dec 19, 2018)
- Registry: https://pkg.go.dev/github.com/apache/thrift
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-55969: v0.12.0 to v0.23.0 (v0.24.0 is outside it)
- CVE-2026-48586: v0.12.0 to v0.23.0 (v0.24.0 is outside it)
- CVE-2026-43871: v0.12.0 to v0.23.0 (v0.24.0 is outside it)
- CVE-2026-41602: v0.12.0 to v0.22.0 (v0.23.0 is outside it)
- CVE-2019-0210: v0.12.0 (v0.13.0 is outside it)
- CVE-2016-5397: no published release is affected

## Advisories (6)

### [CVE-2026-55969](https://cve.now/CVE-2026-55969): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in…

- Severity: High 8.7
- Published: Jul 27, 2026
- Affected: fixed in 0.24.0.
- Fixed in v0.24.0 (released Jul 5, 2026, 22 days before disclosure).
- The latest release, v0.25.0, is not affected.

### [CVE-2026-48586](https://cve.now/CVE-2026-48586): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

- Severity: High 8.7
- Published: Jul 27, 2026
- Affected: fixed in 0.24.0.
- Fixed in v0.24.0 (released Jul 5, 2026, 22 days before disclosure).
- The latest release, v0.25.0, is not affected.

### [CVE-2026-43871](https://cve.now/CVE-2026-43871): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

- Severity: High 8.7
- Published: Jul 27, 2026
- Affected: fixed in 0.24.0; fixed in 0.24.0.
- Fixed in v0.24.0 (released Jul 5, 2026, 22 days before disclosure).
- The latest release, v0.25.0, is not affected.

### [CVE-2026-41602](https://cve.now/CVE-2026-41602): Apache Thrift: Go TFramedTransport uint32 overflow

- Severity: High 7.5
- Published: Apr 28, 2026
- Affected: fixed in 0.23.0.
- Fixed in v0.23.0 (released Apr 15, 2026, 13 days before disclosure).
- The latest release, v0.25.0, is not affected.

### [CVE-2019-0210](https://cve.now/CVE-2019-0210): In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid…

- Severity: Unrated
- Published: Oct 28, 2019
- Affected: from 0.0.0-20151001171628-53dd39833a08, fixed in 0.13.0; from 0.9.3, fixed in 0.13.0.
- Fixed in v0.13.0 (released Oct 11, 2019, 17 days before disclosure).
- The latest release, v0.25.0, is not affected.

### [CVE-2016-5397](https://cve.now/CVE-2016-5397): The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting…

- Severity: Unrated
- Published: Feb 12, 2018
- Affected: fixed in 0.10.0.
- Fixed in v0.12.0 (released Dec 19, 2018, 310 days after disclosure, the advisory names 0.10.0, which was never published).
- The latest release, v0.25.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/apache/thrift
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.