Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
Bitnami VulnDB is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| bit-thrift-2026-96990 | Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound | 2026-10-09T10:53:53.194Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-96294 | Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection | 2026-10-09T10:53:52.001Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-96292 | Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic) | 2026-10-09T10:53:50.805Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-96289 | Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard | 2026-10-09T10:53:49.561Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-96288 | Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) | 2026-10-09T10:53:48.357Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-96287 | Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) | 2026-10-09T10:53:47.282Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-96286 | Apache Thrift: Perl servers end `serve()` when serving one connection fails | 2026-10-09T10:53:46.160Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-96277 | Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception | 2026-10-09T10:53:45.025Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94658 | Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic) | 2026-10-09T10:53:43.829Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94657 | Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound | 2026-10-09T10:53:42.700Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94656 | Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound | 2026-10-09T10:53:41.571Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94655 | Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic | 2026-10-09T10:53:40.349Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94654 | Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame | 2026-10-09T10:53:39.150Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94653 | Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) | 2026-10-09T10:53:37.942Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94652 | Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back | 2026-10-09T10:53:36.758Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94651 | Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error | 2026-10-09T10:53:35.579Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94650 | Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion) | 2026-10-09T10:53:34.380Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94648 | Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound | 2026-10-09T10:53:33.186Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94646 | Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers) | 2026-10-09T10:53:32.001Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94645 | Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound | 2026-10-09T10:53:30.818Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94644 | Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound | 2026-10-09T10:53:29.611Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94642 | Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception | 2026-10-09T10:53:28.362Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94639 | Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) | 2026-10-09T10:53:27.163Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94638 | Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize` | 2026-10-09T10:53:25.987Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94637 | Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame | 2026-10-09T10:53:24.825Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94636 | Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up | 2026-10-09T10:53:23.643Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94635 | Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name | 2026-10-09T10:53:22.448Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94634 | Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default | 2026-10-09T10:53:21.237Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-94633 | Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length | 2026-10-09T10:53:20.057Z | 2026-10-09T11:12:02.352Z |
| bit-thrift-2026-93926 | Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path | 2026-10-09T10:53:18.884Z | 2026-10-09T11:12:02.352Z |