https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:22:49 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-83745 <p>Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift  nodejs and D lang bindings.</p> <p>Both bindings&#39; WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.</p> <p>This issue affects Apache Thrift before 0.25.0.</p> <p>Users are recommended to upgrade to version 0.25.0, which fixes the issue.</p> <p>Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift  nodejs and D lang bindings.</p> <p>Both bindings&#39; WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.</p> <p>This issue affects Apache Thrift before 0.25.0.</p> <p>Users are recommended to upgrade to version 0.25.0, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-83745 https://vulnerability.circl.lu/vuln/ghsa-5jgj-9r28-q5fp <p>Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift  nodejs and D lang bindings.</p> <p>Both bindings&#39; WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.</p> <p>This issue affects Apache Thrift before 0.25.0.</p> <p>Users are recommended to upgrade to version 0.25.0, which fixes the issue.</p> <p>Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift  nodejs and D lang bindings.</p> <p>Both bindings&#39; WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.</p> <p>This issue affects Apache Thrift before 0.25.0.</p> <p>Users are recommended to upgrade to version 0.25.0, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/ghsa-5jgj-9r28-q5fp