目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

Apache Thrift 产品漏洞列表 / CVE 中文分析 31

Apache Thrift 产品相关 31 条漏洞，AI 中文标题与摘要、CVSS、POC 一站汇总。

Apache Thrift 是由 Apache 软件基金会开发的跨语言服务开发框架，本文档聚焦其相关的安全漏洞聚合信息。本页面收录了该组件在数据传输、序列化及协议处理环节中暴露的多种高危缺陷，覆盖时间范围从早期版本发布至今的历史记录，旨在提供全面的技术视角。读者可通过本页追踪官方安全公告的演进脉络，深入了解特定弱点类型的利用机制与修复方案，或检索该产品的历史漏洞数据以评估自身系统的安全风险，从而为版本升级和配置加固提供依据。

ベンダー: Apache Software Foundation

CVE IDタイトルCVSS深刻度公開日
CVE-2026-66053 Apache Thrift: Python TSSLSocket Hostname Matcher Import CWE-297 5.9 Medium2026-07-27
CVE-2026-58662 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CWE-1284 8.7 High2026-07-27
CVE-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit CWE-770 8.7 High2026-07-27
CVE-2026-58023 Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path CWE-125 6.9 Medium2026-07-27
CVE-2026-55971 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CWE-122 9.3 Critical2026-07-27
CVE-2026-55970 Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() CWE-126 6.9 Medium2026-07-27
CVE-2026-55969 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() CWE-190 8.7 High2026-07-27
CVE-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports CWE-407 8.7 High2026-07-27
CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb CWE-409 7.5 High2026-07-27
CVE-2026-48586 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit CWE-409 8.7 High2026-07-27
CVE-2026-48145 Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass CWE-297 8.2 High2026-07-27
CVE-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification CWE-297 9.1 Critical2026-07-27
CVE-2026-45112 Apache Thrift: Unbounded Read Leading to Denial of Service CWE-770 6.9 Medium2026-07-27
CVE-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit CWE-835 8.7 High2026-07-27
CVE-2026-41608 Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport CWE-409--2026-07-27
CVE-2026-43868 Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern CWE-789 9.1 -2026-05-05
CVE-2026-43870 Apache Thrift: Node.js web_server.js multi-vulnerability CWE-346 7.5 -2026-05-05
CVE-2026-43869 Apache Thrift: TSSLTransportFactory.java hostname verification CWE-297 7.5 -2026-05-05
CVE-2026-41636 Apache Thrift: Node.js skip() recursion CWE-674 7.5AIHighAI2026-04-28
CVE-2026-41607 Apache Thrift: C++ JSON OOB read CWE-125 7.5AIHighAI2026-04-28
CVE-2026-41606 Apache Thrift: c_glib dispatch stack overflow CWE-674 7.5AIHighAI2026-04-28
CVE-2026-41605 Apache Thrift: Swift Compact Protocol integer overflow CWE-190 9.8AICriticalAI2026-04-28
CVE-2026-41604 Apache Thrift: Swift Range crash in skip() CWE-125 7.5AIHighAI2026-04-28
CVE-2026-41602 Apache Thrift: Go TFramedTransport uint32 overflow CWE-190 9.8AICriticalAI2026-04-28
CVE-2025-48431 Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. CWE-762 7.5AIHighAI2026-04-28
CVE-2020-13949 Apache Thrift 资源管理错误漏洞 7.5 -2021-02-12
CVE-2019-0205 Apache Thrift 安全漏洞 7.5 -2019-10-28
CVE-2019-0210 Apache Thrift 缓冲区错误漏洞 7.5 -2019-10-28
CVE-2018-1320 Apache Thrift 信任管理问题漏洞 7.5 -2019-01-07
CVE-2018-11798 Apache Thrift Node.js static web服务器访问控制错误漏洞 6.5 -2019-01-07

Apache Thrift 产品累计公开 31 条 CVE 漏洞，本页提供按时间倒序的完整列表，包含 CVSS、CWE、AI 中文摘要与可获取的 POC 链接。