RHSA-2026:74369
Vulnerability from csaf_redhat - Published: 2026-10-01 06:16 - Updated: 2026-10-30 06:54Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
thrift:
* perl-thrift-0.25.0-0.1.hum1 (noarch)
* python3-thrift-0.25.0-0.1.hum1 (aarch64, x86_64)
* thrift-0.25.0-0.1.hum1 (aarch64, x86_64)
* thrift-devel-0.25.0-0.1.hum1 (aarch64, x86_64)
* thrift-glib-0.25.0-0.1.hum1 (aarch64, x86_64)
* thrift-qt-0.25.0-0.1.hum1 (aarch64, x86_64)
* thrift-0.25.0-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these payloads can exhaust system resources and render the service unavailable.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted requests. Because the affected bindings fail to properly restrict resource allocation during request handling, an attacker can exhaust system resources and render the service unavailable.
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's C GLib bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input that triggers the access of an uninitialized pointer. This access can cause the application to crash, resulting in a Denial of Service (DoS).
CWE-824 - Access of Uninitialized PointerAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Delphi bindings buffered transport. The component fails to properly restrict or throttle resource allocation when processing input. A remote, unauthenticated attacker could exploit this vulnerability to consume excessive system resources, resulting in a Denial of Service (DoS).
5.3 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Moderate
A flaw was found in Apache Thrift. An integer overflow within the PHP bindings leads to a stack-based buffer overflow when processing specially crafted data. A remote, unauthenticated attacker could exploit this flaw to crash the service, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. Multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a message containing deeply nested unknown fields, leading to stack exhaustion and causing a Denial of Service (DoS) through an application crash.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by triggering an application crash due to improper memory handling in the C (GLib) bindings. This vulnerability stems from an uninitialized variable and a null pointer dereference during data processing.
CWE-476 - NULL Pointer DereferenceAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. Multiple language bindings fail to properly restrict memory allocation when processing input containing excessive size values. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, consuming available memory and causing a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted network traffic to an affected application. Due to an integer underflow in the 32-bit C++ THeaderTransport component, processing this malformed data triggers an out-of-bounds memory write, leading to an application crash.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) against the Node.js and D WebSocket server transports by sending a frame specifying an excessively large payload length. Because the server immediately allocates the declared amount of memory without verifying that the payload data has arrived, an attacker can rapidly exhaust system memory and crash the service.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Perl bindings. Due to insecure default settings and improper certificate validation, client connections fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could exploit this vulnerability to conduct a man-in-the-middle (MitM) attack, allowing them to eavesdrop on or alter transmitted data and resulting in information disclosure.
7.4 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Python bindings. Due to improper certificate validation and incorrect status code handling, client applications fail to properly verify the authenticity of a remote server during encrypted connections. A remote attacker in a man-in-the-middle position could exploit this vulnerability to intercept and modify sensitive network communications, resulting in information disclosure and data tampering.
7.4 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. During Transport Layer Security (TLS) certificate validation, the client libraries improperly evaluate the certificate's Common Name (CN) when subject alternative name (SAN) entries do not match the target host. A network-positioned attacker possessing a trusted certificate matching the host's Common Name can exploit this vulnerability to impersonate the legitimate server. Successful exploitation allows the attacker to intercept or tamper with encrypted communications.
7.4 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote attacker could cause a Denial of Service (DoS) by sending specially crafted input to an application using the C GLib bindings. Processing this malformed data triggers an infinite loop, consuming system resources and causing the application to become unresponsive.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's C (GLib) bindings. Due to the use of an uninitialized resource and improper status code handling during request processing, the application can enter an inconsistent state. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) or disclose sensitive information.
CWE-908 - Use of Uninitialized ResourceAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Moderate
A flaw was found in Apache Thrift's Dart and Java ME bindings. A remote unauthenticated attacker can exploit this flaw by sending specially crafted requests that trigger excessive recursion. This condition can exhaust system resources and crash the application, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger application crashes or excessive resource consumption, rendering the service unavailable.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote attacker can exploit this vulnerability by submitting specially crafted messages to applications using the Node.js bindings with TJSONProtocol. Successful exploitation can trigger an infinite loop or cause prototype pollution (unintended modification of shared object attributes), resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's JavaScript bindings. An unauthenticated remote attacker can exploit a prototype pollution vulnerability—where shared JavaScript object definitions are modified—by sending specially crafted input to an application using the affected bindings. Successful exploitation may allow an attacker to alter application logic or cause unexpected behavior.
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object AttributesAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Moderate
A flaw was found in Apache Thrift's D language bindings. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infinite loop or terminate unexpectedly.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote attacker could trigger a Denial of Service (DoS) by submitting specially crafted input to an application utilizing the PHP bindings. This condition causes a null pointer dereference, crashing the service and rendering it unavailable to legitimate users.
CWE-476 - NULL Pointer DereferenceAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's D language implementation within the TNonblockingServer component. Due to improper handling of exceptional conditions and improper resource shutdown, an uncaught exception can occur during server operations. A remote, unauthenticated attacker could exploit this vulnerability to cause a Denial of Service (DoS) by terminating the server process.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this vulnerability by sending specially crafted input containing improperly validated quantity values. This causes the application to perform excessive iterations and consume memory or CPU resources without limits, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. The C++ WebSocket server mishandles uninitialized resources and returns an incorrect status code when processing requests. Under specific conditions, a remote attacker could exploit this vulnerability to trigger improper application states and compromise system integrity.
CWE-908 - Use of Uninitialized ResourceAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Moderate
A flaw was found in Apache Thrift. An incorrect bitwise integer shift in the C++ THeaderProtocol implementation can cause a stack-based buffer overflow. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, resulting in a Denial of Service (DoS) caused by an application crash.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's THeaderTransport component. Due to a failure to release allocated memory and system resources after their operational lifetime, a remote attacker can exploit this vulnerability by sending network traffic that repeatedly consumes resources. This issue can cause system memory exhaustion, leading to a Denial of Service (DoS).
CWE-772 - Missing Release of Resource after Effective LifetimeAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Dart bindings. An unauthenticated remote attacker can exploit this vulnerability by sending input containing inconsistent length parameters, triggering excessive memory allocation. This can lead to system memory exhaustion, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in the Apache Thrift Python bindings, which can lead to a Denial of Service (DoS). Due to insecure default settings and a lack of limits or throttling on resource allocation, a remote unauthenticated attacker can cause excessive resource consumption. This behavior can exhaust available system resources and render the affected service unavailable.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in the Apache Thrift Lua bindings. A remote attacker could exploit this vulnerability by sending requests containing inconsistent length parameters, triggering excessive resource allocation without proper limits. This issue can exhaust available system memory or processing capacity, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Python bindings. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending specially crafted input or compressed payloads. Due to improper input validation and improper handling of compressed data, processing these requests can lead to excessive resource consumption.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in the Apache Thrift PHP bindings. Due to a lack of limits or throttling on resource allocation, a remote attacker can send crafted requests that consume excessive system resources. This issue can lead to a Denial of Service (DoS) for the affected service.
5.3 (Medium)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Moderate
A flaw was found in Apache Thrift's PHP bindings. A remote, unauthenticated attacker can exploit this vulnerability by sending requests that trigger unbounded resource allocation without proper limits or throttling. This failure to control consumption can exhaust system resources, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in the Apache Thrift Node.js bindings. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted input specifying improper quantity values. Because the application fails to properly validate the requested quantity before allocating resources, processing these requests can lead to excessive resource consumption and service unavailability.
CWE-606 - Unchecked Input for Loop ConditionAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Node.js bindings. Due to improper input validation and prototype pollution—a condition where base JavaScript object properties can be modified—the application fails to safely process incoming data. A remote attacker can exploit this vulnerability by sending specially crafted input to trigger an uncaught exception, causing the service to crash and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. The Dart bindings fail to properly restrict or throttle resource allocation when processing incoming requests. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, causing excessive resource consumption that leads to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability in the C (GLib) library bindings allows a remote, unauthenticated attacker to send specially crafted input to an affected application. Processing this input triggers excessive nested function calls that exhaust stack memory, causing an application crash and resulting in a Denial of Service (DoS).
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's C++ bindings. A remote attacker can cause a Denial of Service (DoS) by exploiting a memory leak where allocated system memory is not properly released after use. Over time, repeated requests can exhaust available memory and lead to service instability.
CWE-772 - Missing Release of Resource after Effective LifetimeAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Moderate
A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this issue to cause a Denial of Service (DoS) by sending specially crafted input. Due to inefficient algorithmic processing, handling these requests consumes disproportionate computing resources, causing the application to become unresponsive.
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Python bindings. A remote attacker could trigger an infinite loop during data processing, leading to a Denial of Service (DoS). By sending specially crafted input, an attacker can cause the application to hang and consume excessive resources, making the service unavailable to legitimate users.
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted input to an application that uses the Lua bindings. Due to a lack of proper resource allocation limits and inefficient processing, handling these requests consumes excessive system resources and causes the service to become unresponsive.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in the Apache Thrift Ruby bindings. The software does not properly restrict or throttle system resource allocation during request processing. A remote attacker could exploit this vulnerability by sending crafted requests that cause excessive resource consumption, resulting in a Denial of Service (DoS).
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. A remote attacker could exploit improper resource allocation controls in the JavaME bindings to cause a Denial of Service (DoS). By sending requests that trigger unbounded resource consumption, an attacker can exhaust system resources and make the service unavailable.
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift Lua bindings. Due to inefficient algorithmic complexity, a remote, unauthenticated attacker can send specially crafted input to cause excessive resource consumption. This can lead to application unresponsiveness, resulting in a Denial of Service (DoS).
CWE-606 - Unchecked Input for Loop ConditionAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in the Apache Thrift Ruby bindings. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) due to improper handling of exceptional conditions. By triggering an uncaught exception, an attacker can crash the service and disrupt availability.
CWE-248 - Uncaught ExceptionAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift. An uncaught exception within the Perl bindings allows a remote attacker to cause a Denial of Service (DoS). By sending specially crafted input, an attacker can trigger an unhandled error condition, causing the application to crash unexpectedly.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in the Apache Thrift Perl bindings. A remote attacker could exploit this vulnerability by sending specially crafted input to an application using the affected bindings. This triggers inefficient data processing, leading to excessive resource consumption and a Denial of Service (DoS).
CWE-1050 - Excessive Platform Resource Consumption within a LoopAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Erlang bindings. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted input that triggers uncontrolled recursion and unrestricted resource allocation. As a result, the application can exhaust available system memory and processing capacity, leading to a crash or unresponsiveness.
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's PHP bindings. A remote attacker could cause a denial of service (DoS) by sending specially crafted input that triggers uncontrolled recursion. This excessive recursion can exhaust system resources or stack space, leading to an application crash.
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Lua bindings. A remote attacker could exploit this vulnerability by sending specially crafted input that triggers inefficient regular expression processing. This can cause excessive resource consumption, resulting in a Denial of Service (DoS) on the affected service.
CWE-1333 - Inefficient Regular Expression ComplexityAffected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Node.js bindings. A remote attacker can exploit improper exception handling by triggering an uncaught exception. This failure causes the application process to crash, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
A flaw was found in Apache Thrift's Erlang bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending requests that trigger excessive resource allocation without proper limits or throttling. This issue can lead to resource exhaustion, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
13 products, the same list as for
CVE-2026-66054
Threats
Impact
Important
References
311 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nthrift:\n * perl-thrift-0.25.0-0.1.hum1 (noarch)\n * python3-thrift-0.25.0-0.1.hum1 (aarch64, x86_64)\n * thrift-0.25.0-0.1.hum1 (aarch64, x86_64)\n * thrift-devel-0.25.0-0.1.hum1 (aarch64, x86_64)\n * thrift-glib-0.25.0-0.1.hum1 (aarch64, x86_64)\n * thrift-qt-0.25.0-0.1.hum1 (aarch64, x86_64)\n * thrift-0.25.0-0.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:74369",
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94635",
"url": "https://access.redhat.com/security/cve/CVE-2026-94635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93926",
"url": "https://access.redhat.com/security/cve/CVE-2026-93926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94634",
"url": "https://access.redhat.com/security/cve/CVE-2026-94634"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93925",
"url": "https://access.redhat.com/security/cve/CVE-2026-93925"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94633",
"url": "https://access.redhat.com/security/cve/CVE-2026-94633"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85483",
"url": "https://access.redhat.com/security/cve/CVE-2026-85483"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85494",
"url": "https://access.redhat.com/security/cve/CVE-2026-85494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-91137",
"url": "https://access.redhat.com/security/cve/CVE-2026-91137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85087",
"url": "https://access.redhat.com/security/cve/CVE-2026-85087"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-87117",
"url": "https://access.redhat.com/security/cve/CVE-2026-87117"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-90440",
"url": "https://access.redhat.com/security/cve/CVE-2026-90440"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94650",
"url": "https://access.redhat.com/security/cve/CVE-2026-94650"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96294",
"url": "https://access.redhat.com/security/cve/CVE-2026-96294"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94644",
"url": "https://access.redhat.com/security/cve/CVE-2026-94644"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85086",
"url": "https://access.redhat.com/security/cve/CVE-2026-85086"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-82458",
"url": "https://access.redhat.com/security/cve/CVE-2026-82458"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96990",
"url": "https://access.redhat.com/security/cve/CVE-2026-96990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94645",
"url": "https://access.redhat.com/security/cve/CVE-2026-94645"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-82459",
"url": "https://access.redhat.com/security/cve/CVE-2026-82459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85493",
"url": "https://access.redhat.com/security/cve/CVE-2026-85493"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96292",
"url": "https://access.redhat.com/security/cve/CVE-2026-96292"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96288",
"url": "https://access.redhat.com/security/cve/CVE-2026-96288"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66331",
"url": "https://access.redhat.com/security/cve/CVE-2026-66331"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-83745",
"url": "https://access.redhat.com/security/cve/CVE-2026-83745"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94638",
"url": "https://access.redhat.com/security/cve/CVE-2026-94638"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94654",
"url": "https://access.redhat.com/security/cve/CVE-2026-94654"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94657",
"url": "https://access.redhat.com/security/cve/CVE-2026-94657"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96277",
"url": "https://access.redhat.com/security/cve/CVE-2026-96277"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86535",
"url": "https://access.redhat.com/security/cve/CVE-2026-86535"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92834",
"url": "https://access.redhat.com/security/cve/CVE-2026-92834"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94652",
"url": "https://access.redhat.com/security/cve/CVE-2026-94652"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85088",
"url": "https://access.redhat.com/security/cve/CVE-2026-85088"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86536",
"url": "https://access.redhat.com/security/cve/CVE-2026-86536"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94658",
"url": "https://access.redhat.com/security/cve/CVE-2026-94658"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66837",
"url": "https://access.redhat.com/security/cve/CVE-2026-66837"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96289",
"url": "https://access.redhat.com/security/cve/CVE-2026-96289"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66859",
"url": "https://access.redhat.com/security/cve/CVE-2026-66859"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94646",
"url": "https://access.redhat.com/security/cve/CVE-2026-94646"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96287",
"url": "https://access.redhat.com/security/cve/CVE-2026-96287"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96286",
"url": "https://access.redhat.com/security/cve/CVE-2026-96286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85476",
"url": "https://access.redhat.com/security/cve/CVE-2026-85476"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66054",
"url": "https://access.redhat.com/security/cve/CVE-2026-66054"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94636",
"url": "https://access.redhat.com/security/cve/CVE-2026-94636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94656",
"url": "https://access.redhat.com/security/cve/CVE-2026-94656"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66858",
"url": "https://access.redhat.com/security/cve/CVE-2026-66858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66081",
"url": "https://access.redhat.com/security/cve/CVE-2026-66081"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94655",
"url": "https://access.redhat.com/security/cve/CVE-2026-94655"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-66055",
"url": "https://access.redhat.com/security/cve/CVE-2026-66055"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94648",
"url": "https://access.redhat.com/security/cve/CVE-2026-94648"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94653",
"url": "https://access.redhat.com/security/cve/CVE-2026-94653"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86537",
"url": "https://access.redhat.com/security/cve/CVE-2026-86537"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74369.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-10-30T06:54:37+00:00",
"generator": {
"date": "2026-10-30T06:54:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.3"
}
},
"id": "RHSA-2026:74369",
"initial_release_date": "2026-10-01T06:16:09+00:00",
"revision_history": [
{
"date": "2026-10-01T06:16:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-02T16:32:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-30T06:54:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/perl-thrift@0.25.0-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/perl-thrift@0.25.0-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"product": {
"name": "python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"product_id": "python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-thrift@0.25.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-0:0.25.0-0.1.hum1@aarch64",
"product": {
"name": "thrift-0:0.25.0-0.1.hum1@aarch64",
"product_id": "thrift-0:0.25.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift@0.25.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"product": {
"name": "thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"product_id": "thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift-devel@0.25.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"product": {
"name": "thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"product_id": "thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift-glib@0.25.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"product": {
"name": "thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"product_id": "thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift-qt@0.25.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"product": {
"name": "python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"product_id": "python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-thrift@0.25.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-0:0.25.0-0.1.hum1@x86_64",
"product": {
"name": "thrift-0:0.25.0-0.1.hum1@x86_64",
"product_id": "thrift-0:0.25.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift@0.25.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"product": {
"name": "thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"product_id": "thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift-devel@0.25.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"product": {
"name": "thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"product_id": "thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift-glib@0.25.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "thrift-qt-0:0.25.0-0.1.hum1@x86_64",
"product": {
"name": "thrift-qt-0:0.25.0-0.1.hum1@x86_64",
"product_id": "thrift-qt-0:0.25.0-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift-qt@0.25.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "thrift-0:0.25.0-0.1.hum1@src",
"product": {
"name": "thrift-0:0.25.0-0.1.hum1@src",
"product_id": "thrift-0:0.25.0-0.1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thrift@0.25.0-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-thrift-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64"
},
"product_reference": "python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-thrift-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64"
},
"product_reference": "python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64"
},
"product_reference": "thrift-0:0.25.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-0:0.25.0-0.1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src"
},
"product_reference": "thrift-0:0.25.0-0.1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64"
},
"product_reference": "thrift-0:0.25.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-devel-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64"
},
"product_reference": "thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-devel-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64"
},
"product_reference": "thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-glib-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64"
},
"product_reference": "thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-glib-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64"
},
"product_reference": "thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-qt-0:0.25.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64"
},
"product_reference": "thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thrift-qt-0:0.25.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
},
"product_reference": "thrift-qt-0:0.25.0-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-66054",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-10-02T13:14:14.506786+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545180"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these payloads can exhaust system resources and render the service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via improper handling of compressed data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can trigger excessive resource consumption without requiring special privileges or user interaction, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66054"
},
{
"category": "external",
"summary": "RHBZ#2545180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545180"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66054",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66054"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66054",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66054"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33",
"url": "https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33"
}
],
"release_date": "2026-10-02T12:58:05.610000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via improper handling of compressed data"
},
{
"cve": "CVE-2026-66055",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T13:12:59.475207+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545179"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted requests. Because the affected bindings fail to properly restrict resource allocation during request handling, an attacker can exhaust system resources and render the service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because unauthenticated remote attackers can trigger extensive system resource consumption, leading to a complete service outage. In Red Hat environments where Apache Thrift server bindings process external RPC requests, missing bounds on data structures permit malicious callers to overwhelm host memory or processing capacity without requiring valid credentials. Although this issue does not compromise data confidentiality or integrity, the potential to remotely crash or hang production RPC services without prior authorization elevates the risk above Moderate.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66055"
},
{
"category": "external",
"summary": "RHBZ#2545179",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545179"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66055"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66055",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66055"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx",
"url": "https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx"
}
],
"release_date": "2026-10-02T12:49:40.955000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via uncontrolled resource allocation"
},
{
"cve": "CVE-2026-66081",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-10-02T12:54:48.102391+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545165"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s C GLib bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input that triggers the access of an uninitialized pointer. This access can cause the application to crash, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via uninitialized pointer access in c_glib bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important severity because remote unauthenticated attackers can cause a complete denial of service by crashing network-facing processes that rely on the affected library bindings. Within Red Hat environments, Apache Thrift provides serialization and RPC framework capabilities across distributed components, but exposure depends on whether applications specifically integrate the C GLib bindings. Deployments using alternate language implementations, such as standard C++, Python, or Java, are unaffected by this defect.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66081"
},
{
"category": "external",
"summary": "RHBZ#2545165",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545165"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66081",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66081"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66081",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66081"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57",
"url": "https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57"
}
],
"release_date": "2026-10-02T12:33:13.645000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via uninitialized pointer access in c_glib bindings"
},
{
"cve": "CVE-2026-66331",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T13:00:06.119575+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Delphi bindings buffered transport. The component fails to properly restrict or throttle resource allocation when processing input. A remote, unauthenticated attacker could exploit this vulnerability to consume excessive system resources, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity rather than Important because exploitation is limited to denial-of-service conditions through unconstrained memory allocation without compromising system confidentiality or integrity. The affected buffered transport implementation is exclusive to Apache Thrift\u0027s Delphi language bindings. Because Red Hat enterprise distributions and supported products do not package or utilize Delphi components, standard installations are not exposed to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66331"
},
{
"category": "external",
"summary": "RHBZ#2545175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66331"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66331",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66331"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143",
"url": "https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143"
}
],
"release_date": "2026-10-02T12:32:46.166000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport"
},
{
"cve": "CVE-2026-66837",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-02T12:53:32.129609+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545163"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. An integer overflow within the PHP bindings leads to a stack-based buffer overflow when processing specially crafted data. A remote, unauthenticated attacker could exploit this flaw to crash the service, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via buffer overflow in PHP bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can submit crafted network input to trigger memory corruption, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66837"
},
{
"category": "external",
"summary": "RHBZ#2545163",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545163"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66837"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66837",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66837"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1",
"url": "https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1"
}
],
"release_date": "2026-10-02T12:29:09.189000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via buffer overflow in PHP bindings"
},
{
"cve": "CVE-2026-66858",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:56:52.055546+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545169"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. Multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a message containing deeply nested unknown fields, leading to stack exhaustion and causing a Denial of Service (DoS) through an application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Denial of Service via deeply nested unknown fields",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because remote, unauthenticated attackers can cause an immediate denial of service by crashing affected services over the network without prior authentication or special privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66858"
},
{
"category": "external",
"summary": "RHBZ#2545169",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545169"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66858"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66858",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66858"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5",
"url": "https://lists.apache.org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5"
}
],
"release_date": "2026-10-02T12:27:31.412000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Denial of Service via deeply nested unknown fields"
},
{
"cve": "CVE-2026-66859",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-02T12:58:16.859618+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545172"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by triggering an application crash due to improper memory handling in the C (GLib) bindings. This vulnerability stems from an uninitialized variable and a null pointer dereference during data processing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via NULL pointer dereference in c_glib bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity for Red Hat because an unauthenticated remote attacker can crash network services relying on Thrift without requiring privileges or user interaction, leading to a complete loss of service availability. In Red Hat environments, the exposure is limited to deployments hosting services that explicitly utilize the Apache Thrift C (GLib) language bindings to process untrusted client input. Applications leveraging other Thrift runtime language implementations are not susceptible to this specific memory handling flaw.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66859"
},
{
"category": "external",
"summary": "RHBZ#2545172",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545172"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66859"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66859",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66859"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o",
"url": "https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o"
}
],
"release_date": "2026-10-02T12:23:48.346000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via NULL pointer dereference in c_glib bindings"
},
{
"cve": "CVE-2026-82458",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T11:41:23.724436+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545042"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. Multiple language bindings fail to properly restrict memory allocation when processing input containing excessive size values. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, consuming available memory and causing a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via excessive memory allocation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important rather than Moderate because an unauthenticated network actor can trigger unbound memory exhaustion without requiring credentials or user participation, resulting in denial of service. In Red Hat environments, Apache Thrift is utilized across container runtimes and distributed storage platforms, where communication interfaces are frequently constrained to private networks, local host boundaries, or container pod boundaries. However, services configured to expose Thrift RPC listeners to untrusted network traffic are fully exposed to service termination and resource starvation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82458"
},
{
"category": "external",
"summary": "RHBZ#2545042",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545042"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82458"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7",
"url": "https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7"
}
],
"release_date": "2026-10-02T11:30:51.264000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via excessive memory allocation"
},
{
"cve": "CVE-2026-82459",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-02T11:41:06.160175+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545041"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted network traffic to an affected application. Due to an integer underflow in the 32-bit C++ THeaderTransport component, processing this malformed data triggers an out-of-bounds memory write, leading to an application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via integer underflow in THeaderTransport",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger a denial of service or unexpected service termination by sending malformed network traffic to applications utilizing Apache Thrift. The flaw resides in the handling of the THeaderTransport protocol within the C++ implementation, where integer underflow conditions during transport parsing can lead to memory corruption. Because services consuming Thrift often process RPC requests across network boundaries, exploitation directly affects application availability without requiring prior authentication or user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-82459"
},
{
"category": "external",
"summary": "RHBZ#2545041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545041"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-82459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-82459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82459"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2",
"url": "https://lists.apache.org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2"
}
],
"release_date": "2026-10-02T11:32:30.148000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via integer underflow in THeaderTransport"
},
{
"cve": "CVE-2026-83745",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-10-02T12:24:50.036523+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545142"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) against the Node.js and D WebSocket server transports by sending a frame specifying an excessively large payload length. Because the server immediately allocates the declared amount of memory without verifying that the payload data has arrived, an attacker can rapidly exhaust system memory and crash the service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via excessive memory allocation in WebSocket transport",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important due to the potential for unauthenticated remote attackers to cause severe memory exhaustion leading to service denial without requiring user interaction or elevated privileges. The flaw specifically impacts server endpoints implementing WebSocket transports within Thrift\u0027s Node.js or D language bindings. Red Hat environments and deployments that do not expose services over WebSockets or that utilize alternate language bindings (such as C++ or Python) are not susceptible to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83745"
},
{
"category": "external",
"summary": "RHBZ#2545142",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545142"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83745"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc",
"url": "https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc"
}
],
"release_date": "2026-10-02T12:16:15.128000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Restrict network reachability to services exposing Apache Thrift WebSocket transports by limiting access to trusted IP addresses or binding exclusively to the loopback interface.\n\n1. If remote access is not required, configure the application to listen only on localhost (127.0.0.1).\n\n2. To restrict exposure using firewalld, remove the service port from public zones and allow access only from trusted IP subnets:\n\nfirewall-cmd --permanent --zone=public --remove-port=\u003cPORT\u003e/tcp\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_OR_CIDR\u003e\nfirewall-cmd --permanent --zone=trusted --add-port=\u003cPORT\u003e/tcp\nfirewall-cmd --reload\n\nCaveat: Restricting network access prevents legitimate clients outside of the trusted subnet from connecting to the service.\n\nWarning: Executing \u0027firewall-cmd --reload\u0027 applies configuration changes immediately and may disrupt active network connections.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via excessive memory allocation in WebSocket transport"
},
{
"cve": "CVE-2026-85086",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-02T11:52:29.698780+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Perl bindings. Due to insecure default settings and improper certificate validation, client connections fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could exploit this vulnerability to conduct a man-in-the-middle (MitM) attack, allowing them to eavesdrop on or alter transmitted data and resulting in information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Information disclosure via improper certificate validation in Perl bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important impact because unauthenticated network adversaries positioned between endpoints can compromise session confidentiality and integrity by intercepting unverified TLS handshakes. The flaw specifically impacts custom client implementations utilizing Apache Thrift\u0027s Perl language bindings that communicate over encrypted channels.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85086"
},
{
"category": "external",
"summary": "RHBZ#2545053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85086"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85086",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85086"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy",
"url": "https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy"
}
],
"release_date": "2026-10-02T11:34:00.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Information disclosure via improper certificate validation in Perl bindings"
},
{
"cve": "CVE-2026-85087",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-02T11:55:16.489915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545068"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Python bindings. Due to improper certificate validation and incorrect status code handling, client applications fail to properly verify the authenticity of a remote server during encrypted connections. A remote attacker in a man-in-the-middle position could exploit this vulnerability to intercept and modify sensitive network communications, resulting in information disclosure and data tampering.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Python \u22653.12 host-name check silently becomes a no-op",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because it completely invalidates TLS server identity verification, exposing encrypted traffic to complete loss of confidentiality and integrity even though exploitation requires an adversary to achieve a man-in-the-middle network position. In Red Hat environments, the risk is concentrated in deployments where Python applications employ Thrift clients to establish encrypted connections on modern runtimes. Because the failure occurs silently during the handshake, affected services continue communication under the false assumption of transport security.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85087"
},
{
"category": "external",
"summary": "RHBZ#2545068",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545068"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85087",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85087"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0d",
"url": "https://lists.apache.org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0d"
}
],
"release_date": "2026-10-02T11:35:44.871000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Python \u22653.12 host-name check silently becomes a no-op"
},
{
"cve": "CVE-2026-85088",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-02T11:59:54.540051+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545088"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. During Transport Layer Security (TLS) certificate validation, the client libraries improperly evaluate the certificate\u0027s Common Name (CN) when subject alternative name (SAN) entries do not match the target host. A network-positioned attacker possessing a trusted certificate matching the host\u0027s Common Name can exploit this vulnerability to impersonate the legitimate server. Successful exploitation allows the attacker to intercept or tamper with encrypted communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Man-in-the-middle attacks via improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as an Important severity because it allows a machine-in-the-middle adversary on the network path to bypass TLS hostname validation, completely compromising transport confidentiality and integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85088"
},
{
"category": "external",
"summary": "RHBZ#2545088",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545088"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85088",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85088"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85088",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85088"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371",
"url": "https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371"
}
],
"release_date": "2026-10-02T11:37:14.749000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Man-in-the-middle attacks via improper certificate validation"
},
{
"cve": "CVE-2026-85476",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-10-02T12:21:47.110774+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545134"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote attacker could cause a Denial of Service (DoS) by sending specially crafted input to an application using the C GLib bindings. Processing this malformed data triggers an infinite loop, consuming system resources and causing the application to become unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact for Red Hat deployments because an unauthenticated remote client can induce complete service unavailability and CPU exhaustion without requiring specialized privileges. The flaw specifically affects network daemons and RPC endpoints developed against Thrift\u0027s C GLib transport layer, where an abrupt connection termination or zero-length read response enters an unconstrained execution state. While data confidentiality and integrity remain uncompromised, the ease of triggering process lockups over the network warrants an Important rating rather than Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85476"
},
{
"category": "external",
"summary": "RHBZ#2545134",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545134"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85476"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85476",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85476"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jj",
"url": "https://lists.apache.org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jj"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
}
],
"release_date": "2026-10-02T12:12:45.468000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0"
},
{
"cve": "CVE-2026-85483",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2026-10-02T10:53:08.472989+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545018"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s C (GLib) bindings. Due to the use of an uninitialized resource and improper status code handling during request processing, the application can enter an inconsistent state. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) or disclose sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Moderate severity because, although exploitable over the network without authentication, the blast radius is confined to individual processes utilizing the C GLib bindings configured with compressed transport. In typical deployments, services must explicitly implement the `TZlibTransport` wrapper to be exposed to premature stream termination issues. Consequently, the impact is limited to an application crash or exposure of uninitialized memory buffers, and workloads using alternative Thrift language bindings or uncompressed transports are unaffected.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85483"
},
{
"category": "external",
"summary": "RHBZ#2545018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545018"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85483"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85483",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85483"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfy",
"url": "https://lists.apache.org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfy"
}
],
"release_date": "2026-10-02T10:46:55.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "thrift: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end"
},
{
"cve": "CVE-2026-85493",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T10:50:56.445191+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545016"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Dart and Java ME bindings. A remote unauthenticated attacker can exploit this flaw by sending specially crafted requests that trigger excessive recursion. This condition can exhaust system resources and crash the application, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because unauthenticated remote attackers can trigger an application crash across the network without requiring any prior authorization. The defect exists during the processing of deeply nested payload structures within Thrift implementations for Dart and Java ME, culminating in uncontrolled stack consumption. However, Red Hat platforms do not standardly provide or support Dart or Java ME runtimes, so typical enterprise environments remain unaffected unless custom workloads specifically utilize these bindings.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85493"
},
{
"category": "external",
"summary": "RHBZ#2545016",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545016"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85493"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85493",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85493"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m",
"url": "https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m"
}
],
"release_date": "2026-10-02T10:45:57.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)"
},
{
"cve": "CVE-2026-85494",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-10-02T10:54:18.453376+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545019"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger application crashes or excessive resource consumption, rendering the service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via improper message handling in language bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity impact because unauthenticated remote attackers can exhaust system resources or crash processes over the network without requiring privileges, leading to a complete loss of service availability. In Red Hat environments, Apache Thrift is utilized across distributed storage and machine learning platforms to handle remote procedure calls between service components. Systems deploying custom or integrated services that expose affected Thrift language bindings to untrusted networks face increased exposure, whereas deployments operating strictly within isolated, private cluster networks substantially limit external attack surfaces.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85494"
},
{
"category": "external",
"summary": "RHBZ#2545019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545019"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85494"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr",
"url": "https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr"
}
],
"release_date": "2026-10-02T10:42:44.813000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via improper message handling in language bindings"
},
{
"cve": "CVE-2026-86535",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-10-02T12:13:50.425036+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545128"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote attacker can exploit this vulnerability by submitting specially crafted messages to applications using the Node.js bindings with TJSONProtocol. Successful exploitation can trigger an infinite loop or cause prototype pollution (unintended modification of shared object attributes), resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via TJSONProtocol in Node.js bindings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86535"
},
{
"category": "external",
"summary": "RHBZ#2545128",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545128"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86535"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86535",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86535"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g",
"url": "https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g"
}
],
"release_date": "2026-10-02T11:38:16.628000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via TJSONProtocol in Node.js bindings"
},
{
"cve": "CVE-2026-86536",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-10-02T11:56:35.237316+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545075"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s JavaScript bindings. An unauthenticated remote attacker can exploit a prototype pollution vulnerability\u2014where shared JavaScript object definitions are modified\u2014by sending specially crafted input to an application using the affected bindings. Successful exploitation may allow an attacker to alter application logic or cause unexpected behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Prototype pollution in JavaScript bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having a Moderate severity because exploitation requires an application to deserialize attacker-supplied data via the affected JavaScript bindings, potentially altering object properties and internal program logic rather than enabling direct code execution. In typical Red Hat deployments, Apache Thrift is primarily used for backend service communication across compiled native or Python implementations, which remain unaffected. Systems are only exposed if custom or third-party Node.js and browser applications consume untrusted Thrift payloads.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86536"
},
{
"category": "external",
"summary": "RHBZ#2545075",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545075"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86536"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86536",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86536"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp",
"url": "https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp"
}
],
"release_date": "2026-10-02T11:40:06.911000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "thrift: thrift: Prototype pollution in JavaScript bindings"
},
{
"cve": "CVE-2026-86537",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-10-02T12:08:46.104212+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545121"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s D language bindings. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infinite loop or terminate unexpectedly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via infinite loop in D language bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can trigger a denial of service over the network without requiring privileges, leading to an infinite loop that halts service availability. However, this flaw is isolated to the Apache Thrift D language bindings, which are neither compiled nor supported in Red Hat environments. Red Hat product deployments rely on alternate language implementations, such as C++ and Python, and are therefore unaffected by this issue in typical configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86537"
},
{
"category": "external",
"summary": "RHBZ#2545121",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545121"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86537"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86537",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86537"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m",
"url": "https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m"
}
],
"release_date": "2026-10-02T11:40:51.704000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via infinite loop in D language bindings"
},
{
"cve": "CVE-2026-87117",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-02T11:53:13.788403+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545058"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote attacker could trigger a Denial of Service (DoS) by submitting specially crafted input to an application utilizing the PHP bindings. This condition causes a null pointer dereference, crashing the service and rendering it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because an unauthenticated remote attacker can induce a denial of service by transmitting malformed serialized data without requiring elevated privileges or interaction. In Red Hat deployments shipping Apache Thrift, exposure is limited to environments where PHP-based services or applications accept and process untrusted RPC messages using the Thrift protocol accelerator. Although the resulting crash terminates the handling process without compromising data confidentiality or system integrity, repeated attacks can lead to persistent disruption of critical backend workflows.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87117"
},
{
"category": "external",
"summary": "RHBZ#2545058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545058"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87117"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87117",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87117"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy",
"url": "https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy"
}
],
"release_date": "2026-10-02T11:43:11.832000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec"
},
{
"cve": "CVE-2026-90440",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-02T11:54:45.756003+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545066"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s D language implementation within the TNonblockingServer component. Due to improper handling of exceptional conditions and improper resource shutdown, an uncaught exception can occur during server operations. A remote, unauthenticated attacker could exploit this vulnerability to cause a Denial of Service (DoS) by terminating the server process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via improper exception handling in TNonblockingServer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an unauthenticated remote attacker can trigger an unhandled exception leading to immediate server termination, resulting in a denial of service without requiring privileges or user interaction. In Red Hat environments, Apache Thrift is utilized as an RPC framework across distributed services, where exposure depends on deployment architecture and network visibility. Additionally, this flaw specifically targets the D language implementation of the non-blocking server, which is generally not enabled or utilized in standard enterprise deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90440"
},
{
"category": "external",
"summary": "RHBZ#2545066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545066"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90440"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg",
"url": "https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg"
}
],
"release_date": "2026-10-02T11:44:11.636000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Restrict network exposure by limiting access to Apache Thrift service ports to localhost or trusted internal networks. Using firewalld, access can be restricted by binding the listening port only to trusted source addresses:\n\n```\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_CIDR\u003e\nfirewall-cmd --permanent --zone=public --remove-port=\u003cPORT\u003e/tcp\nfirewall-cmd --reload\n```\n\nReplace `\u003cTRUSTED_CIDR\u003e` with your authorized network subnet and `\u003cPORT\u003e` with the port used by the Thrift server application.\n\nWarning: Reloading firewalld configuration applies changes immediately and may drop existing network connections. Ensure management access is preserved before altering firewall zones.\n\nCaveats: Restricting network reachability prevents external or untrusted clients from communicating with the Thrift service, which may impact applications that require broader network access.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via improper exception handling in TNonblockingServer"
},
{
"cve": "CVE-2026-91137",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-10-02T10:31:24.576275+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s PHP bindings. A remote attacker can exploit this vulnerability by sending specially crafted input containing improperly validated quantity values. This causes the application to perform excessive iterations and consume memory or CPU resources without limits, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because unauthenticated remote attackers can trigger severe resource exhaustion and completely disrupt service availability. In deployments utilizing the Thrift PHP protocol accelerator to parse network payloads, an attacker can transmit malformed container structures that induce unbounded execution cycles and excessive memory allocation. Impact is confined to denial of service, with no unauthorized disclosure or alteration of system data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91137"
},
{
"category": "external",
"summary": "RHBZ#2545007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91137"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7",
"url": "https://lists.apache.org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7"
}
],
"release_date": "2026-10-02T10:18:38.062000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements"
},
{
"cve": "CVE-2026-92834",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2026-10-02T12:34:42.499649+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. The C++ WebSocket server mishandles uninitialized resources and returns an incorrect status code when processing requests. Under specific conditions, a remote attacker could exploit this vulnerability to trigger improper application states and compromise system integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: C++ WebSocket server transport does not read a full request length",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires specific transport conditions in the Apache Thrift C++ WebSocket server implementation and leads only to limited integrity impact without enabling code execution or denial of service. In default Red Hat deployments, Thrift-based C++ WebSocket servers are not configured or exposed as standard system services. The risk is primarily confined to environments that explicitly deploy custom services utilizing this specific WebSocket transport.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92834"
},
{
"category": "external",
"summary": "RHBZ#2545154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92834"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92834",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92834"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0",
"url": "https://lists.apache.org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0"
}
],
"release_date": "2026-10-02T11:45:25.930000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "thrift: Apache Thrift: C++ WebSocket server transport does not read a full request length"
},
{
"cve": "CVE-2026-93925",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-02T10:31:47.430017+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545010"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. An incorrect bitwise integer shift in the C++ THeaderProtocol implementation can cause a stack-based buffer overflow. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, resulting in a Denial of Service (DoS) caused by an application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via stack-based buffer overflow in THeaderProtocol",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can cause an immediate service crash over the network without requiring privileges or user interaction. Applications and dependent services utilizing the Thrift C++ library\u0027s header protocol implementation are exposed to process termination upon receiving malformed network frames. The impact remains confined to service availability and does not compromise system confidentiality or data integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93925"
},
{
"category": "external",
"summary": "RHBZ#2545010",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545010"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93925"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93925",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93925"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9",
"url": "https://lists.apache.org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9"
}
],
"release_date": "2026-10-02T10:16:17.913000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via stack-based buffer overflow in THeaderProtocol"
},
{
"cve": "CVE-2026-93926",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-10-02T10:31:33.640474+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545008"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s THeaderTransport component. Due to a failure to release allocated memory and system resources after their operational lifetime, a remote attacker can exploit this vulnerability by sending network traffic that repeatedly consumes resources. This issue can cause system memory exhaustion, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via memory leak in THeaderTransport",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93926"
},
{
"category": "external",
"summary": "RHBZ#2545008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93926"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb",
"url": "https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb"
}
],
"release_date": "2026-10-02T10:13:55.957000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via memory leak in THeaderTransport"
},
{
"cve": "CVE-2026-94633",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T10:32:20.890715+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545011"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Dart bindings. An unauthenticated remote attacker can exploit this vulnerability by sending input containing inconsistent length parameters, triggering excessive memory allocation. This can lead to system memory exhaustion, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via excessive memory allocation in Dart bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important severity because an unauthenticated remote attacker can induce unbounded memory consumption over the network, leading to service disruption without requiring user interaction. However, this issue specifically affects the Dart language bindings of Apache Thrift, which are neither packaged nor enabled in standard Red Hat product distributions. Consequently, typical Red Hat deployments utilizing Thrift are not exposed to this flaw unless custom Dart implementations are built and exposed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94633"
},
{
"category": "external",
"summary": "RHBZ#2545011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94633"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94633",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94633"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k",
"url": "https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k"
}
],
"release_date": "2026-10-02T10:13:00.027000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via excessive memory allocation in Dart bindings"
},
{
"cve": "CVE-2026-94634",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T10:21:22.736268+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544998"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift Python bindings, which can lead to a Denial of Service (DoS). Due to insecure default settings and a lack of limits or throttling on resource allocation, a remote unauthenticated attacker can cause excessive resource consumption. This behavior can exhaust available system resources and render the affected service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an unauthenticated network adversary can cause complete denial of service through memory exhaustion without requiring any prior access or user interaction. In Apache Thrift Python bindings, the TJSONProtocol parser processes incoming serialized payloads without enforcing string length boundaries by default. Red Hat environments utilizing these Python bindings in network-facing applications are susceptible to service unresponsiveness or daemon termination when handling untrusted JSON payloads.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94634"
},
{
"category": "external",
"summary": "RHBZ#2544998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94634"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94634",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94634"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4",
"url": "https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4"
}
],
"release_date": "2026-10-02T10:11:20.762000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default"
},
{
"cve": "CVE-2026-94635",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-10-02T09:32:01.870379+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift Lua bindings. A remote attacker could exploit this vulnerability by sending requests containing inconsistent length parameters, triggering excessive resource allocation without proper limits. This issue can exhaust available system memory or processing capacity, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates the impact of this vulnerability as Important because an unauthenticated remote attacker can trigger excessive resource consumption leading to a denial of service without requiring credentials or user interaction. Exposure across Red Hat environments is confined to deployments actively implementing Thrift network services built with the Lua language bindings. Typical installations that do not expose Lua-bound Thrift network interfaces to untrusted traffic remain unaffected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94635"
},
{
"category": "external",
"summary": "RHBZ#2544989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3",
"url": "https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3"
}
],
"release_date": "2026-10-02T09:07:56.691000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Restrict network exposure by limiting access to applications utilizing Apache Thrift Lua bindings to trusted network segments or binding listening services strictly to localhost (127.0.0.1).\n\nTo restrict network access to the port utilized by the Thrift service using firewalld:\n\n1. Remove public exposure of the service port:\n# firewall-cmd --permanent --remove-port=\u003cPORT\u003e/tcp\n\n2. Restrict communication to a trusted IP subnet:\n# firewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_CIDR\u003e\n\n3. Reload firewalld to apply the changes:\n# firewall-cmd --reload\n\nWarning: Reloading the firewall configuration may temporarily interrupt active connections. Blocking this port will prevent any unauthorized or untrusted remote clients from communicating with the service.\n\nAdditionally, avoid deploying or running services that implement Apache Thrift via its Lua bindings if not strictly required by your workloads.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings"
},
{
"cve": "CVE-2026-94636",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-10-02T12:35:49.494431+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545155"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Python bindings. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending specially crafted input or compressed payloads. Due to improper input validation and improper handling of compressed data, processing these requests can lead to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity for Red Hat because remote, unauthenticated attackers can cause a complete denial of service by exhausting server memory through uncontrolled data amplification. In Red Hat deployments, the risk specifically affects environments running custom Python services built on Apache Thrift that enable zlib-compressed transport layers. Systems where Thrift endpoints are restricted to localhost or trusted internal networks experience reduced risk, and the issue cannot be leveraged for arbitrary code execution or data exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94636"
},
{
"category": "external",
"summary": "RHBZ#2545155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545155"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94636"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs",
"url": "https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
}
],
"release_date": "2026-10-02T11:47:54.613000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up"
},
{
"cve": "CVE-2026-94638",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:40:39.685068+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545160"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift PHP bindings. Due to a lack of limits or throttling on resource allocation, a remote attacker can send crafted requests that consume excessive system resources. This issue can lead to a Denial of Service (DoS) for the affected service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Moderate impact because exploitation is limited to availability degradation via resource exhaustion, with no compromise to data confidentiality or system integrity. Impact is further constrained in Red Hat environments because the issue is isolated to the PHP language bindings, whereas Red Hat product deployments utilize Apache Thrift primarily for C++ or Python internal communications. Consequently, systems running default Red Hat product configurations do not expose the affected PHP bindings to untrusted remote requests.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94638"
},
{
"category": "external",
"summary": "RHBZ#2545160",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545160"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94638",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94638"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94638",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94638"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/v60w786pqr7njzz9425grby8yjrgmbsj",
"url": "https://lists.apache.org/thread/v60w786pqr7njzz9425grby8yjrgmbsj"
}
],
"release_date": "2026-10-02T11:49:43.765000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings"
},
{
"cve": "CVE-2026-94644",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T11:01:45.455478+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545021"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s PHP bindings. A remote, unauthenticated attacker can exploit this vulnerability by sending requests that trigger unbounded resource allocation without proper limits or throttling. This failure to control consumption can exhaust system resources, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache/thrift: thrift: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because unauthenticated remote attackers can exhaust system memory without prior privileges or user interaction, leading to denial of service. In Red Hat environments, Apache Thrift PHP bindings are typically deployed within container images or backend web services that handle RPC communications. Systems are only vulnerable if they expose PHP endpoints utilizing the TJSONProtocol to untrusted networks. Deployments that restrict Thrift RPC endpoints to trusted internal networks or that do not utilize PHP bindings are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94644"
},
{
"category": "external",
"summary": "RHBZ#2545021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545021"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94644",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94644"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94644",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94644"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzq",
"url": "https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzq"
}
],
"release_date": "2026-10-02T10:53:37.255000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "apache/thrift: thrift: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound"
},
{
"cve": "CVE-2026-94645",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-10-02T11:03:19.900534+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545022"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift Node.js bindings. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted input specifying improper quantity values. Because the application fails to properly validate the requested quantity before allocating resources, processing these requests can lead to excessive resource consumption and service unavailability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity impact because unauthenticated remote attackers can exhaust system resources and render services unavailable without requiring prior access or interaction. In typical Red Hat environments, the issue specifically impacts Node.js applications exposing Apache Thrift services configured with the TJSONProtocol parser. Services that do not deserialize untrusted TJSONProtocol payloads or that isolate network access to trusted internal clients are not exposed to this denial-of-service vector.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94645"
},
{
"category": "external",
"summary": "RHBZ#2545022",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545022"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94645",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94645"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6",
"url": "https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6"
}
],
"release_date": "2026-10-02T10:51:40.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound"
},
{
"cve": "CVE-2026-94646",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-10-02T12:23:11.847024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545138"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Node.js bindings. Due to improper input validation and prototype pollution\u2014a condition where base JavaScript object properties can be modified\u2014the application fails to safely process incoming data. A remote attacker can exploit this vulnerability by sending specially crafted input to trigger an uncaught exception, causing the service to crash and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via prototype pollution in Node.js bindings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94646"
},
{
"category": "external",
"summary": "RHBZ#2545138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545138"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94646"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8",
"url": "https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8"
}
],
"release_date": "2026-10-02T11:52:21.192000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via prototype pollution in Node.js bindings"
},
{
"cve": "CVE-2026-94648",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:28:55.996113+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545149"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. The Dart bindings fail to properly restrict or throttle resource allocation when processing incoming requests. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted input, causing excessive resource consumption that leads to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an unauthenticated remote attacker can trigger a denial of service through unbounded resource allocation without requiring elevated privileges. The defect specifically resides within the Apache Thrift Dart language bindings, which are neither packaged nor supported in Red Hat Enterprise Linux. Consequently, standard Red Hat deployments do not expose this vulnerability under default configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94648"
},
{
"category": "external",
"summary": "RHBZ#2545149",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545149"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94648"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/f9w4q6ttlc3k9404x4do25gdhqodtjnn",
"url": "https://lists.apache.org/thread/f9w4q6ttlc3k9404x4do25gdhqodtjnn"
}
],
"release_date": "2026-10-02T11:52:48.907000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound"
},
{
"cve": "CVE-2026-94650",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T11:01:28.298445+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545020"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability in the C (GLib) library bindings allows a remote, unauthenticated attacker to send specially crafted input to an affected application. Processing this input triggers excessive nested function calls that exhaust stack memory, causing an application crash and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via uncontrolled recursion in C GLib bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can trigger a denial of service by submitting specially crafted requests that induce deep recursion and exhaust system memory. The issue is strictly confined to applications and services using Apache Thrift\u0027s C GLib language bindings to handle untrusted network communications. Deployments that do not expose services built with these specific bindings, or that use alternative Thrift language libraries, are not affected.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94650"
},
{
"category": "external",
"summary": "RHBZ#2545020",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545020"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94650",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94650"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94650",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94650"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/poskkt3p754b2f293g63934hw160o86j",
"url": "https://lists.apache.org/thread/poskkt3p754b2f293g63934hw160o86j"
}
],
"release_date": "2026-10-02T10:49:37.521000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via uncontrolled recursion in C GLib bindings"
},
{
"cve": "CVE-2026-94652",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-10-02T12:21:59.706266+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545135"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s C++ bindings. A remote attacker can cause a Denial of Service (DoS) by exploiting a memory leak where allocated system memory is not properly released after use. Over time, repeated requests can exhaust available memory and lead to service instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via memory leak in C++ bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because, while an unauthenticated remote client can induce resource depletion over extended periods, exploitation does not permit code execution or compromise data confidentiality and integrity. Within Red Hat offerings such as Red Hat Ceph Storage, Thrift is typically utilized for backend cluster communication rather than directly exposed to untrusted public networks, significantly constraining external attack vectors. Successful exploitation necessitates sustained transmission of requests to accumulate unreleased memory, resulting in process termination or daemon unresponsiveness rather than persistent host compromise.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94652"
},
{
"category": "external",
"summary": "RHBZ#2545135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545135"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94652",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94652"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94652",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94652"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727",
"url": "https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727"
}
],
"release_date": "2026-10-02T11:54:41.996000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "thrift: thrift: Denial of Service via memory leak in C++ bindings"
},
{
"cve": "CVE-2026-94653",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:36:38.976855+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545156"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s PHP bindings. A remote attacker can exploit this issue to cause a Denial of Service (DoS) by sending specially crafted input. Due to inefficient algorithmic processing, handling these requests consumes disproportionate computing resources, causing the application to become unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote actor can induce excessive CPU consumption and trigger a denial of service without needing prior privileges. In Red Hat environments, exposure is limited to deployments serving endpoints implemented with Apache Thrift PHP bindings using framed, memory, or HTTP transport layers. Applications that do not expose PHP-based Thrift services to untrusted networks or that do not utilize the PHP transport bindings are not affected by this flaw.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94653"
},
{
"category": "external",
"summary": "RHBZ#2545156",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545156"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94653",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94653"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94653",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94653"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4m",
"url": "https://lists.apache.org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4m"
}
],
"release_date": "2026-10-02T11:56:35.706000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)"
},
{
"cve": "CVE-2026-94654",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-10-02T12:25:49.319870+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545145"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Python bindings. A remote attacker could trigger an infinite loop during data processing, leading to a Denial of Service (DoS). By sending specially crafted input, an attacker can cause the application to hang and consume excessive resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via infinite loop in Python bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can exploit it to cause complete process lockup and service unavailability without requiring privileges. In Red Hat environments, Apache Thrift is not typically deployed as an exposed standalone service by default, but custom or integrated applications utilizing these Python bindings to parse untrusted network payloads remain vulnerable. Because an infinite parsing loop directly monopolizes CPU resources and starves legitimate operations, affected worker processes must be manually restarted to restore normal functionality.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94654"
},
{
"category": "external",
"summary": "RHBZ#2545145",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545145"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94654"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94654",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94654"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7j",
"url": "https://lists.apache.org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7j"
}
],
"release_date": "2026-10-02T11:58:49.429000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via infinite loop in Python bindings"
},
{
"cve": "CVE-2026-94655",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:26:30.081617+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545146"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted input to an application that uses the Lua bindings. Due to a lack of proper resource allocation limits and inefficient processing, handling these requests consumes excessive system resources and causes the service to become unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because an unauthenticated remote attacker can cause a complete denial of service across the network without requiring privileges. The risk is specific to deployments utilizing Apache Thrift with Lua bindings that parse untrusted payloads via the JSON protocol. In environments where Thrift endpoints are isolated from untrusted networks or where the Lua bindings and JSON protocol are not implemented, the practical exposure is substantially minimized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94655"
},
{
"category": "external",
"summary": "RHBZ#2545146",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545146"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94655"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94655",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94655"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt",
"url": "https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt"
}
],
"release_date": "2026-10-02T11:59:18.277000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic"
},
{
"cve": "CVE-2026-94656",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:22:50.109650+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545136"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift Ruby bindings. The software does not properly restrict or throttle system resource allocation during request processing. A remote attacker could exploit this vulnerability by sending crafted requests that cause excessive resource consumption, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact for Red Hat environments because unauthenticated remote attackers can trigger complete denial of service across the network without user interaction by consuming excessive server memory. While typical Thrift deployments rely on binary or compact serialization formats, applications exposing Thrift services that utilize Ruby bindings configured with JSON protocols (`TJsonProtocol` or `TJSONProtocol`) lack upper bounds on string sizes during payload parsing. Consequently, processing maliciously oversized JSON strings can lead to process termination via out-of-memory exhaustion, though confidentiality and system integrity remain unaffected.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94656"
},
{
"category": "external",
"summary": "RHBZ#2545136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545136"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94656"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94656",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94656"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8",
"url": "https://lists.apache.org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8"
}
],
"release_date": "2026-10-02T12:00:51.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound"
},
{
"cve": "CVE-2026-94657",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:27:57.067572+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545148"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. A remote attacker could exploit improper resource allocation controls in the JavaME bindings to cause a Denial of Service (DoS). By sending requests that trigger unbounded resource consumption, an attacker can exhaust system resources and make the service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker could trigger a denial of service through unthrottled resource consumption. The flaw is specifically confined to Apache Thrift JavaME bindings, which are designed for resource-constrained Java Micro Edition environments.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94657"
},
{
"category": "external",
"summary": "RHBZ#2545148",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545148"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94657"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94657",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94657"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14",
"url": "https://lists.apache.org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14"
}
],
"release_date": "2026-10-02T12:01:36.606000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings"
},
{
"cve": "CVE-2026-94658",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-10-02T12:27:11.880130+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545147"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift Lua bindings. Due to inefficient algorithmic complexity, a remote, unauthenticated attacker can send specially crafted input to cause excessive resource consumption. This can lead to application unresponsiveness, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via inefficient algorithmic complexity in Lua bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can exploit the flaw across the network to cause sustained CPU or memory exhaustion without needing privileges or user interaction. The impact is limited to network services utilizing Apache Thrift\u0027s Lua bindings to process untrusted input; deployments using other Thrift language implementations are not affected. In typical Red Hat environments, Lua-based Thrift server deployments are uncommon, significantly reducing the exposure for standard workloads.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94658"
},
{
"category": "external",
"summary": "RHBZ#2545147",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545147"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94658"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94658",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94658"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/hv6b1nyk2p15gy5pmtprwo7z9m46mfcx",
"url": "https://lists.apache.org/thread/hv6b1nyk2p15gy5pmtprwo7z9m46mfcx"
}
],
"release_date": "2026-10-02T12:02:21.823000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via inefficient algorithmic complexity in Lua bindings"
},
{
"cve": "CVE-2026-96277",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-02T12:39:08.569139+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545159"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift Ruby bindings. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) due to improper handling of exceptional conditions. By triggering an uncaught exception, an attacker can crash the service and disrupt availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via uncaught exception in Ruby bindings",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96277"
},
{
"category": "external",
"summary": "RHBZ#2545159",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545159"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96277"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/k1t5r9sz7k5tn57cnf5khw2ywlxv6098",
"url": "https://lists.apache.org/thread/k1t5r9sz7k5tn57cnf5khw2ywlxv6098"
}
],
"release_date": "2026-10-02T12:03:23.964000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via uncaught exception in Ruby bindings"
},
{
"cve": "CVE-2026-96286",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-02T12:33:42.354172+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545153"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. An uncaught exception within the Perl bindings allows a remote attacker to cause a Denial of Service (DoS). By sending specially crafted input, an attacker can trigger an unhandled error condition, causing the application to crash unexpectedly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Perl servers end `serve()` when serving one connection fails",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having an Important severity impact because an unauthenticated remote attacker can crash the server process, resulting in a denial of service. The flaw specifically affects deployments utilizing Apache Thrift Perl server bindings, where malformed or unexpected client communication triggers an unhandled exception that terminates the main service loop. Implementations using Apache Thrift libraries in other programming languages or client-only Perl bindings are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96286"
},
{
"category": "external",
"summary": "RHBZ#2545153",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545153"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96286"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9",
"url": "https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9"
}
],
"release_date": "2026-10-02T12:04:28.083000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Perl servers end `serve()` when serving one connection fails"
},
{
"cve": "CVE-2026-96287",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-10-02T12:37:44.480679+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545158"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift Perl bindings. A remote attacker could exploit this vulnerability by sending specially crafted input to an application using the affected bindings. This triggers inefficient data processing, leading to excessive resource consumption and a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can exhaust server CPU resources and induce a persistent denial of service without requiring user interaction or elevated privileges. In typical Red Hat environments, Apache Thrift Perl modules are not deployed in core system services by default and require custom applications utilizing framed transports or TLS sockets to be exposed to untrusted network traffic. The risk is therefore primarily confined to environments where custom Perl-based Thrift servers process unauthenticated external requests.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96287"
},
{
"category": "external",
"summary": "RHBZ#2545158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545158"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96287"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9",
"url": "https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9"
}
],
"release_date": "2026-10-02T12:05:59.449000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)"
},
{
"cve": "CVE-2026-96288",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T11:31:10.072024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545038"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Erlang bindings. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted input that triggers uncontrolled recursion and unrestricted resource allocation. As a result, the application can exhaust available system memory and processing capacity, leading to a crash or unresponsiveness.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can exploit the lack of recursion depth limits during struct deserialization to exhaust system memory and crash the service. In Red Hat environments, exposure is limited to deployments using Apache Thrift Erlang bindings to accept and process untrusted RPC messages. Systems not implementing Erlang-based Thrift services or isolating these endpoints from untrusted networks are not susceptible to this attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96288"
},
{
"category": "external",
"summary": "RHBZ#2545038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96288"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96288",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96288"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzb",
"url": "https://lists.apache.org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzb"
}
],
"release_date": "2026-10-02T11:18:37.005000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)"
},
{
"cve": "CVE-2026-96289",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T12:29:56.665186+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545150"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s PHP bindings. A remote attacker could cause a denial of service (DoS) by sending specially crafted input that triggers uncontrolled recursion. This excessive recursion can exhaust system resources or stack space, leading to an application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Important because an unauthenticated network adversary can trigger a complete service outage via stack exhaustion without needing prior credentials or interaction. Exposure is restricted to deployments running PHP applications that parse untrusted Thrift serialized data, specifically where inlined struct deserialization or binary skip routines are utilized. While the defect allows termination of the executing worker process, it does not allow unauthorized data access or code execution.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96289"
},
{
"category": "external",
"summary": "RHBZ#2545150",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545150"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96289"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96289",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96289"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8",
"url": "https://lists.apache.org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8"
}
],
"release_date": "2026-10-02T12:07:02.827000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard"
},
{
"cve": "CVE-2026-96292",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-10-02T11:30:57.884653+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545035"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Lua bindings. A remote attacker could exploit this vulnerability by sending specially crafted input that triggers inefficient regular expression processing. This can cause excessive resource consumption, resulting in a Denial of Service (DoS) on the affected service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: thrift: Denial of Service via inefficient regular expression evaluation in Lua bindings",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because unauthenticated remote attackers can induce significant CPU resource exhaustion without requiring privileges, leading to service disruption. The issue is specific to deployments utilizing Apache Thrift\u0027s Lua bindings, whereas common architectures utilizing C++, Java, or Python implementations are unaffected.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96292"
},
{
"category": "external",
"summary": "RHBZ#2545035",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545035"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96292"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn",
"url": "https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn"
}
],
"release_date": "2026-10-02T11:11:33.256000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: thrift: Denial of Service via inefficient regular expression evaluation in Lua bindings"
},
{
"cve": "CVE-2026-96294",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-10-02T11:31:01.812869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545036"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Node.js bindings. A remote attacker can exploit improper exception handling by triggering an uncaught exception. This failure causes the application process to crash, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important severity because unauthenticated remote network clients can abruptly terminate the application process by exploiting missing exception handling during WebSocket upgrade events, resulting in a complete denial of service. Within Red Hat environments, Apache Thrift is typically deployed as an RPC framework in specialized application stacks rather than an enabled system daemon. Only server deployments that actively implement the Node.js bindings for WebSocket communication are vulnerable; applications utilizing alternative language runtimes or non-upgraded HTTP endpoints remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96294"
},
{
"category": "external",
"summary": "RHBZ#2545036",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545036"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96294"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96294",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96294"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4",
"url": "https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4"
}
],
"release_date": "2026-10-02T11:09:56.230000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection"
},
{
"cve": "CVE-2026-96990",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-02T11:12:11.380329+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545025"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s Erlang bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending requests that trigger excessive resource allocation without proper limits or throttling. This issue can lead to resource exhaustion, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with an Important severity because an unauthenticated network-based attacker can cause an out-of-memory crash, leading to a complete service outage on affected hosts without requiring user interaction. The unbounded message ingestion specifically impacts deployments using Apache Thrift Erlang bindings when processing incoming JSON protocol payloads. In standard Red Hat product configurations, Thrift is not enabled as an Erlang service by default, restricting real-world exposure to customized environments running affected Erlang network endpoints.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96990"
},
{
"category": "external",
"summary": "RHBZ#2545025",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545025"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96990"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1",
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh",
"url": "https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh"
}
],
"release_date": "2026-10-02T11:00:27.495000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-01T06:16:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:74369"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:perl-thrift-0:0.25.0-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:python3-thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@src",
"Red Hat Hardened Images:thrift-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-devel-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-glib-0:0.25.0-0.1.hum1@x86_64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@aarch64",
"Red Hat Hardened Images:thrift-qt-0:0.25.0-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.