announce  

Messages by Thread

• CVE-2026-79983: Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-79984: Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-84178: Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow Andrea Cosentino
• CVE-2026-78164: Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers Andrea Cosentino
• CVE-2026-71569: Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name Andrea Cosentino
• CVE-2026-78163: Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure Andrea Cosentino
• CVE-2026-78162: Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) Andrea Cosentino
• CVE-2026-79985: Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-80344: Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address Andrea Cosentino
• CVE-2026-84176: Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection Andrea Cosentino
• CVE-2026-84180: Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication Enxin Xie
• CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content Enxin Xie
• CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content Enxin Xie
• CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Enxin Xie
• CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Enxin Xie
• CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Enxin Xie
• CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Enxin Xie
• CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Enxin Xie
• CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Enxin Xie
• CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Enxin Xie
• CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup Enxin Xie
• CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Enxin Xie
• CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Enxin Xie
• CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation Li Yang
• CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass Li Yang
• CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF Li Yang
• CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization Li Yang
• CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection Li Yang
• CVE-2026-108766: Apache Kylin: missing JDBC-config authorization Li Yang
• CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue Li Yang
• CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement Li Yang
• CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion Li Yang
• CVE-2026-108833: Apache Kylin: default startup profile miss security settings Li Yang
• CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard Li Yang
• CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass Li Yang
• CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup Li Yang
• CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env Li Yang
• CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController Li Yang
• CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints Li Yang
• CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) Li Yang
• CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure Li Yang
• CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump Li Yang
• CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization Li Yang
• CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk
  • CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk
• CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default Jarek Potiuk
• CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token Jarek Potiuk
• CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read Jarek Potiuk
• [ANNOUNCE] Apache Camel 4.23.0 Released Gregor Zurowski
• [ANNOUNCE] Apache Pekko HTTP 1.4.2 released PJ Fanning
• [ANNOUNCE] Apache SeaTunnel 3.0.0 Released — A Major Milestone Release lidongdai
• [ANNOUNCE] Apache SedonaDB 0.5.0 released Dewey Dunnington
• [ANNOUNCEMENT] HttpComponents Core 5.5-beta4 released Oleg Kalnichevski
• [ANNOUNCE] Apache SIS 1.7 Release Martin Desruisseaux
• [ANNOUNCE] Apache Tika 3.3.3 released Tim Allison
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-06 are released Jarek Potiuk
• CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding Shuxin Pan
• [ANNOUNCE] Apache Pulsar Helm Chart version 4.8.0 Released Lari Hotari
• Subject: [ANNOUNCE] Release Apache Paimon Rust 0.4.0 hope
• CVE-2026-92119: Apache Allura: REST API Mass Assignment Dave Brondsema
• CVE-2026-92116: Apache Allura: OAuth1 missing callback validation Dave Brondsema
• CVE-2026-92120: Apache Allura: Oauth1 Replay Attack Dave Brondsema
• [ANNOUNCEMENT] HttpComponents Client 5.6.5 Released Oleg Kalnichevski
• [ANN] Apache Tomcat 11.0.27 Available Mark Thomas
• [ANN] Apache Tomcat 9.0.123 available Rémy Maucherat
• [ANN] Apache Tomcat 10.1.61 Available Christopher Schultz
• [ANNOUNCE] Apache CouchDB 3.5.3 released Jan Lehnardt
  • Re: [ANNOUNCE] Apache CouchDB 3.5.3 released Jan Lehnardt
• [ANNOUNCE] Apache Camel 4.18.5 (LTS) Released Gregor Zurowski
• [ANNOUNCE] Apache Commons Codec 1.23.0 Gary Gregory
• CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens Colm O hEigeartaigh
• CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch Lee Rhodes
• CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
• CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
• CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch Lee Rhodes
• CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch Lee Rhodes
• CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests Colm O hEigeartaigh
• CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. Colm O hEigeartaigh
• [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.4 released David Jensen
• CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits Colm O hEigeartaigh
• CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git Andrea Cosentino
• CVE-2026-79650: Apache CXF: OIDC RP Open Redirect Colm O hEigeartaigh
• CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml Andrea Cosentino
• CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. Colm O hEigeartaigh
• CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security Colm O hEigeartaigh
• CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic Colm O hEigeartaigh
• CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) Colm O hEigeartaigh
• CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter Colm O hEigeartaigh
• CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service Colm O hEigeartaigh
• [ANNOUNCE] Apache Maka 0.2.0 (incubating) released Yuhan Lei
• Apache Beam 2.77.0 Released! Vitalii Terentev
• CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint Wenjun Ruan
• CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） Wenjun Ruan
• CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords Wenjun Ruan
• CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint Wenjun Ruan
• CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information Wenjun Ruan
• CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials Wenjun Ruan
• CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File Jinwoo Hwang
• [ANNOUNCE] Apache Jackrabbit 2.23.6-beta released Julian Reschke
• CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Julian Reschke
• CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Julian Reschke
• [ANNOUNCE] Apache Jackrabbit 2.22.5 released Julian Reschke
• [ANNOUNCE] Apache Pekko HTTP 1.4.1 released PJ Fanning
• [ANNOUNCE] Apache Jackrabbit 2.20.18 released Julian Reschke
• CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name Wilfred Spiegelenburg
• [ANNOUNCE] Apache YuniKorn v1.10.0 released Wilfred Spiegelenburg
• CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation Wilfred Spiegelenburg
• CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery Wilfred Spiegelenburg
• [ANNOUNCE] Apache Impala 4.5.3 release Michael Smith
• CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans Michael Smith
• CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass Michael Smith
• CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths Michael Smith
• CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records Jan Friedrich
• CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS Gary D. Gregory
• CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser Gary D. Gregory
• CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter Jan Friedrich
• CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records Jan Friedrich
• CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch Jan Friedrich
• CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded Jan Friedrich
• CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content Jan Friedrich
• [ANNOUNCE] Apache Commons Secure XML 1.1.0 Gary Gregory
• [ANNOUNCE] Apache Pulsar 5.0.0 LTS released Lari Hotari
• [ANNOUNCE] Apache James 3.9.1 released Benoit TELLIER (Apache)
• [ANNOUNCE] Apache Pulsar 4.0.14 released Lari Hotari
• [ANNOUNCE] Apache Pulsar 4.2.5 released Lari Hotari
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-02 are released Shahar Epstein
• [ANNOUNCE] Apache Pekko (Core) 1.7.1 released PJ Fanning
• [ANN] Apache Tomcat Migration tool for Jakarta EE 1.0.13 Mark Thomas
• [ANNOUNCE] OpenDAL 0.59.4-rc.2 released xuanwo
• CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin Lukasz Lenart
• CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests Lukasz Lenart
• CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper Lukasz Lenart
• CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters Lukasz Lenart
• [ANNOUNCE] Grails Publish Gradle Plugin 1.0.0-RC2 Mattias Reichel
• CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Dave Fisher
• [ANN] Apache Struts 6.12.0 Lukasz Lenart
• CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values Emmanuel Lécharny
• [ANNOUNCE] Apache Gravitino 1.3.1 released Bharath Krishna
• [ANN] Apache Struts 7.4.0 Lukasz Lenart
• CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode Emmanuel Lécharny
• CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements Emmanuel Lécharny
• CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords Emmanuel Lécharny
• CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS Emmanuel Lécharny
• CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder Emmanuel Lécharny
• CVE-2026-96292: Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic) Jens Geyer
• CVE-2026-61373: Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation Jens Geyer
• CVE-2026-61374: Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit Jens Geyer
• CVE-2026-66837: Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length Jens Geyer
• CVE-2026-66081: Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages Jens Geyer
• CVE-2026-66331: Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize Jens Geyer
• CVE-2026-63772: Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count Jens Geyer
• CVE-2026-66055: Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language) Jens Geyer
• CVE-2026-66858: Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml) Jens Geyer
• CVE-2026-83663: Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go) Jens Geyer
• CVE-2026-83632: Apache Thrift: C++ THttpTransport grows its line buffer without bound Jens Geyer
• CVE-2026-94651: Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error Jens Geyer
• CVE-2026-82459: Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process Jens Geyer
• CVE-2026-66859: Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route Jens Geyer
• CVE-2026-85086: Apache Thrift: Perl TLS client disables certificate verification by default Jens Geyer
• CVE-2026-66054: Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize Jens Geyer
• CVE-2026-85088: Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match Jens Geyer
• CVE-2026-85087: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op Jens Geyer
• CVE-2026-83745: Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D) Jens Geyer
• CVE-2026-85483: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end Jens Geyer
• CVE-2026-85476: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0 Jens Geyer
• CVE-2026-82458: Apache Thrift: Container element count not bounded by the bytes available Jens Geyer
• CVE-2026-85494: Apache Thrift: Framed transport and binary protocol size a read buffer from a peer-declared length with no effective maximum (multi-language) Jens Geyer
• CVE-2026-85493: Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) Jens Geyer
• CVE-2026-86535: Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely Jens Geyer
• CVE-2026-86536: Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript Jens Geyer
• CVE-2026-94655: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic Jens Geyer
• CVE-2026-94636: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up Jens Geyer
• CVE-2026-96990: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound Jens Geyer
• CVE-2026-94650: Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion) Jens Geyer
• CVE-2026-94648: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound Jens Geyer
• CVE-2026-90440: Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service Jens Geyer
• CVE-2026-86537: Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service Jens Geyer
• CVE-2026-93925: Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id Jens Geyer
• CVE-2026-94633: Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length Jens Geyer
• CVE-2026-94634: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default Jens Geyer
• CVE-2026-87117: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec Jens Geyer
• CVE-2026-91137: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements Jens Geyer
• CVE-2026-94652: Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back Jens Geyer
• CVE-2026-94646: Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers) Jens Geyer
• CVE-2026-94653: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) Jens Geyer
• CVE-2026-91135: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) Jens Geyer
• CVE-2026-94657: Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound Jens Geyer
• CVE-2026-92834: Apache Thrift: C++ WebSocket server transport does not read a full request length Jens Geyer
• CVE-2026-93926: Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path Jens Geyer
• CVE-2026-96286: Apache Thrift: Perl servers end `serve()` when serving one connection fails Jens Geyer
• CVE-2026-94638: Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize` Jens Geyer
• CVE-2026-94654: Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame Jens Geyer
• CVE-2026-94656: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound Jens Geyer
• CVE-2026-94639: Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) Jens Geyer
• CVE-2026-96289: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard Jens Geyer
• CVE-2026-96277: Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception Jens Geyer
• CVE-2026-96288: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) Jens Geyer
• CVE-2026-96287: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) Jens Geyer
• CVE-2026-94645: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound Jens Geyer

• Earlier messages
• Later messages