Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
CVE-2026-94655
Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
#microsoft
共收录 2274 条相关情报。
← 返回所有主题Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
CVE-2026-96292
Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
CVE-2026-96288
Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)
Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
CVE-2026-87117
Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
CVE-2026-61373
Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
CVE-2026-94650
Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
CVE-2026-94642
Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)
CVE-2026-94658
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)
Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
CVE-2026-94651
Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
net: lan743x: fix RX checksum use-after-free
CVE-2026-98239
net: lan743x: fix RX checksum use-after-free
Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
CVE-2026-66859
Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
CVE-2026-98306
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
CVE-2026-94644
Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
selinux: preserve user SID across nested backing files
CVE-2026-98215
selinux: preserve user SID across nested backing files
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
CVE-2026-94657
Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound
net: bridge: mst: move switchdev call outside rcu
CVE-2026-98301
net: bridge: mst: move switchdev call outside rcu
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
CVE-2026-98176
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
CVE-2026-94633
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
CVE-2026-66331
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
ALSA: core: Fix potential UAF after asynchronous card release
CVE-2026-98266
ALSA: core: Fix potential UAF after asynchronous card release