Technology · Apache
Apache Thrift vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 77 vulnerabilities in Apache Thrift: 0 in the last 7 days and 61 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120135, was published on 31 October 2026. 1 vulnerability in the last four weeks, down 98% on the four before (60).
- Last 7 days
- 0
- Last 90 days
- 61
- Critical, all time
- 0
- Exploited in the wild
- 0
About Apache Thrift
Serialization framework for data interchange between services in multiple programming languages.
Latest Apache Thrift vulnerabilities
- CVE-2026-120135: Apache Thrift uncontrolled recursion in Java bindingsinfo
- CVE-2026-96289: Apache Thrift uncontrolled recursion in PHP bindingsinfoEPSS 0.4%
- CVE-2026-96287: Apache Thrift Perl bindings inefficient algorithmic complexityinfoEPSS 0.4%
- CVE-2026-96286: Apache Thrift uncaught exception in Perl bindingsinfoEPSS 0.4%
- CVE-2026-96277: Apache Thrift Ruby bindings exception handling vulnerabilityinfoEPSS 0.4%
- CVE-2026-94658: Apache Thrift inefficient algorithmic complexity in Lua bindingsinfoEPSS 0.4%
- CVE-2026-94657: Apache Thrift resource exhaustion in JavaME bindingsinfoEPSS 0.4%
- CVE-2026-94656: Apache Thrift ruby bindings resource exhaustioninfoEPSS 0.4%
- CVE-2026-94655: Apache Thrift Lua bindings resource exhaustioninfoEPSS 0.4%
- CVE-2026-94654: Apache Thrift infinite loop in Python bindingsinfoEPSS 0.4%
- CVE-2026-85476: Apache Thrift infinite loop in c_glib bindingsinfoEPSS 0.4%
- CVE-2026-83745: Apache Thrift memory exhaustion in WebSocket transportsinfoEPSS 0.4%
- CVE-2026-83663: Apache Thrift uncontrolled recursion in Go transportsinfoEPSS 0.4%
- CVE-2026-83632: Apache Thrift multiple heap and buffer vulnerabilitiesinfoEPSS 0.4%
- CVE-2026-66859: Apache Thrift NULL pointer dereference in c_glib bindingsinfoEPSS 0.4%
- CVE-2026-66858: Apache Thrift stack overflow in protocol skip routineinfoEPSS 0.3%
- CVE-2026-66837: Apache Thrift stack-based buffer overflow in PHP bindingsinfoEPSS 0.3%
- CVE-2026-66331: Apache Thrift resource exhaustion in Delphi buffered transportinfoEPSS 0.4%
- CVE-2026-66081: Apache Thrift access of uninitialized pointer in c_glib bindingsinfoEPSS 0.4%
- CVE-2026-66055: Apache Thrift resource allocation denial of serviceinfoEPSS 0.3%
- CVE-2026-66054: Apache Thrift data amplification in C++ bindingsinfoEPSS 0.4%
- CVE-2026-63772: Apache Thrift resource exhaustion in Go bindingsinfoEPSS 0.4%
- CVE-2026-61374: Apache Thrift Java bindings resource exhaustioninfoEPSS 0.2%
- CVE-2026-96294: Apache Thrift NodeJS bindings uncaught exception handlinginfoEPSS 0.4%
- CVE-2026-96292: Apache Thrift Lua bindings inefficient regex complexityinfoEPSS 0.4%
Most severe Apache Thrift vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-41604: Apache Thrift out-of-bounds read in Swift Range skip functionhighCVSS 8.2EPSS 0.6%
- CVE-2026-41602: Apache Thrift integer overflow in Go TFramedTransporthighCVSS 7.5EPSS 1.4%
- CVE-2026-43871: Apache Thrift infinite loop in Python, Go, PHP and Java bindingshighCVSS 7.5EPSS 1.0%
- CVE-2026-41608: Apache Thrift data amplification in Python THeaderTransporthighCVSS 7.5EPSS 1.0%
- CVE-2025-48431: Apache Thrift denial of service in c_glib language bindingshighCVSS 7.5EPSS 0.7%
- CVE-2026-41636: Apache Thrift Node.js bindings uncontrolled recursionhighCVSS 7.5EPSS 0.4%
- CVE-2026-41603: Apache Thrift improper certificate validation in Java TSSLTransportFactoryhighCVSS 7.4EPSS 0.3%
- CVE-2026-43869: Apache Thrift improper certificate validation in TSSLTransportFactoryhighCVSS 7.3EPSS 0.8%
- CVE-2026-41605: Apache Thrift integer overflow in Swift Compact ProtocolhighCVSS 7.3EPSS 0.5%
- CVE-2026-43870: Apache Thrift path traversal and request splitting in web serverhighCVSS 7.3EPSS 0.4%
Vulnerabilities per week
1 vulnerability in the last four weeks, down 98% on the four before (60). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 60 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache Thrift vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/thrift)<a href="https://junglewise.ai/threats/technologies/thrift"><img src="https://junglewise.ai/threats/technologies/thrift/badge.svg" alt="Apache Thrift vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/thrift.json, and this page as text at https://junglewise.ai/threats/technologies/thrift.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache Thrift vulnerabilities", https://junglewise.ai/threats/technologies/thrift, 12 November 2026.