Riskcovery

CVE-2026-55969

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

State
Published
Severity
8.7 High
Published
Jul 27, 2026
Updated
Jul 27, 2026
Reserved
Jun 17, 2026

Read the record on cve.org

Description

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Napache

Weaknesses

  • CWE-190 Integer Overflow or Wraparound

Affected Products

ProductVersions
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.