CVE Browser

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit

Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the confi…

Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize

Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, P…

Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route

Apache Thrift: C++ THttpTransport grows its line buffer without bound

Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)

Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Apache Thrift: c_glib `read_all` spins when the underlying read returns 0

Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard

Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)

Apache Thrift: Perl servers end `serve()` when serving one connection fails

Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)

Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound

Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic

Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame

Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)