# org.apache.thrift:libthrift (Maven) vulnerabilities 9 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.25.0 (Oct 1, 2026): no advisory affects it - Newest unaffected release: 0.25.0 (Oct 1, 2026), the latest release - Dependents: 341 - Releases: 27 since 0.6.1 (Apr 20, 2011) - Registry: https://central.sonatype.com/artifact/org.apache.thrift/libthrift - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-120135: 0.6.1 to 0.23.0 (0.24.0 is outside it) - CVE-2026-48586: 0.6.1 to 0.23.0 (0.24.0 is outside it) - CVE-2026-45112: 0.19.0 to 0.23.0 (0.24.0 is outside it) - CVE-2026-43871: 0.6.1 to 0.23.0 (0.24.0 is outside it) - CVE-2026-43869: 0.6.1 to 0.22.0 (0.23.0 is outside it) - CVE-2020-13949: 0.9.3 to 0.13.0 (0.14.0 is outside it) - CVE-2019-0205: 0.6.1 to 0.12.0 (0.13.0 is outside it) - CVE-2018-1320: 0.6.1 to 0.9.3 (0.9.3-1 is outside it); 0.10.0 to 0.11.0 (0.12.0 is outside it) - CVE-2018-11798: 0.9.2 to 0.11.0 (0.12.0 is outside it) ## Advisories (9) ### [CVE-2026-120135](https://cve.now/CVE-2026-120135): Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default - Severity: High 8.2 - Published: Oct 31, 2026 - Affected: fixed in 0.24.0. - Fixed in 0.24.0 (released Jul 11, 2026, 112 days before disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2026-48586](https://cve.now/CVE-2026-48586): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit - Severity: High 8.7 - Published: Jul 27, 2026 - Affected: fixed in 0.24.0. - Fixed in 0.24.0 (released Jul 11, 2026, 16 days before disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2026-45112](https://cve.now/CVE-2026-45112): Apache Thrift: Unbounded Read Leading to Denial of Service - Severity: Medium 6.9 - Published: Jul 27, 2026 - Affected: from 0.19.0, fixed in 0.24.0. - Fixed in 0.24.0 (released Jul 11, 2026, 16 days before disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2026-43871](https://cve.now/CVE-2026-43871): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit - Severity: High 8.7 - Published: Jul 27, 2026 - Affected: fixed in 0.24.0; fixed in 0.24.0. - Fixed in 0.24.0 (released Jul 11, 2026, 16 days before disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2026-43869](https://cve.now/CVE-2026-43869): Apache Thrift: TSSLTransportFactory.java hostname verification - Severity: High 7.3 - Published: May 5, 2026 - Affected: fixed in 0.23.0. - Fixed in 0.23.0 (released May 8, 2026, 3 days after disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2020-13949](https://cve.now/CVE-2020-13949): In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation… - Severity: Unrated - Published: Feb 12, 2021 - Affected: from 0.9.3, fixed in 0.14.0. - Fixed in 0.14.0 (released Feb 24, 2021, 12 days after disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2019-0205](https://cve.now/CVE-2019-0205): In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input… - Severity: Unrated - Published: Oct 28, 2019 - Affected: fixed in 0.13.0. - Fixed in 0.13.0 (released Nov 17, 2019, 20 days after disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2018-1320](https://cve.now/CVE-2018-1320): Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the… - Severity: Unrated - Published: Jan 7, 2019 - Affected: from 0.5.0, fixed in 0.9.3-1; from 0.10.0, fixed in 0.12.0. - Fixed in 0.9.3-1 (released Feb 19, 2019, 43 days after disclosure) and 0.12.0 (released Jan 22, 2019, 15 days after disclosure). - The latest release, 0.25.0, is not affected. ### [CVE-2018-11798](https://cve.now/CVE-2018-11798): The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in… - Severity: Unrated - Published: Jan 7, 2019 - Affected: from 0.9.2, fixed in 0.12.0. - Fixed in 0.12.0 (released Jan 22, 2019, 15 days after disclosure). - The latest release, 0.25.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.thrift:libthrift Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.