MavenPackage

org.apache.thrift:libthrift

9 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 0.25.0 (Oct 1, 2026): no advisory affects it
Newest unaffected release: 0.25.0 (Oct 1, 2026), the latest release
Advisories: 9 · 4 high, 1 medium

Dependents: 341
Releases: 27 since 0.6.1 (Apr 20, 2011)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-120135
Affects 0.6.1 to 0.23.0 (0.24.0 is outside it)
CVE-2026-48586
Affects 0.6.1 to 0.23.0 (0.24.0 is outside it)
CVE-2026-45112
Affects 0.19.0 to 0.23.0 (0.24.0 is outside it)
CVE-2026-43871
Affects 0.6.1 to 0.23.0 (0.24.0 is outside it)
CVE-2026-43869
Affects 0.6.1 to 0.22.0 (0.23.0 is outside it)
CVE-2020-13949
Affects 0.9.3 to 0.13.0 (0.14.0 is outside it)
CVE-2019-0205
Affects 0.6.1 to 0.12.0 (0.13.0 is outside it)
CVE-2018-1320
Affects 0.6.1 to 0.9.3 (0.9.3-1 is outside it); 0.10.0 to 0.11.0 (0.12.0 is outside it)
CVE-2018-11798
Affects 0.9.2 to 0.11.0 (0.12.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-120135High 8.2
Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Affected: fixed in 0.24.0.
Fixed in 0.24.0 (released Jul 11, 2026, 112 days before disclosure).
The latest release, 0.25.0, is not affected.
CVE-2026-48586High 8.7
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
Affected: fixed in 0.24.0.
Fixed in 0.24.0 (released Jul 11, 2026, 16 days before disclosure).
The latest release, 0.25.0, is not affected.
CVE-2026-45112Medium 6.9
Apache Thrift: Unbounded Read Leading to Denial of Service
Affected: from 0.19.0, fixed in 0.24.0.
Fixed in 0.24.0 (released Jul 11, 2026, 16 days before disclosure).
The latest release, 0.25.0, is not affected.
CVE-2026-43871High 8.7
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Affected: fixed in 0.24.0; fixed in 0.24.0.
Fixed in 0.24.0 (released Jul 11, 2026, 16 days before disclosure).
The latest release, 0.25.0, is not affected.
CVE-2026-43869High 7.3
Apache Thrift: TSSLTransportFactory.java hostname verification
Affected: fixed in 0.23.0.
Fixed in 0.23.0 (released May 8, 2026, 3 days after disclosure).
The latest release, 0.25.0, is not affected.
CVE-2020-13949Unrated
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation…
Affected: from 0.9.3, fixed in 0.14.0.
Fixed in 0.14.0 (released Feb 24, 2021, 12 days after disclosure).
The latest release, 0.25.0, is not affected.
CVE-2019-0205Unrated
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input…
Affected: fixed in 0.13.0.
Fixed in 0.13.0 (released Nov 17, 2019, 20 days after disclosure).
The latest release, 0.25.0, is not affected.
CVE-2018-1320Unrated
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…
Affected: from 0.5.0, fixed in 0.9.3-1; from 0.10.0, fixed in 0.12.0.
Fixed in 0.9.3-1 (released Feb 19, 2019, 43 days after disclosure) and 0.12.0 (released Jan 22, 2019, 15 days after disclosure).
The latest release, 0.25.0, is not affected.
CVE-2018-11798Unrated
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in…
Affected: from 0.9.2, fixed in 0.12.0.
Fixed in 0.12.0 (released Jan 22, 2019, 15 days after disclosure).
The latest release, 0.25.0, is not affected.