-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 25 Jul 2026 09:27:54 +0200 Source: thrift Binary: golang-thrift-dev libthrift-0.24.0 libthrift-0.24.0-dbgsym libthrift-c-glib-dev libthrift-c-glib0t64 libthrift-c-glib0t64-dbgsym libthrift-dev libthrift-perl php-thrift php-thrift-dbgsym python3-thrift python3-thrift-dbgsym thrift-compiler thrift-compiler-dbgsym Architecture: source all amd64 Version: 0.24.0-1 Distribution: experimental Urgency: medium Maintainer: Laszlo Boszormenyi (GCS) <[email protected]> Changed-By: Laszlo Boszormenyi (GCS) <[email protected]> Description: golang-thrift-dev - Go language support for Thrift libthrift-0.24.0 - Thrift C++ library libthrift-c-glib-dev - Thrift glib library (development headers) libthrift-c-glib0t64 - Thrift glib library libthrift-dev - Thrift C++ library (development headers) libthrift-perl - Perl language support for Thrift php-thrift - PHP language support for Thrift python3-thrift - Python 3 library for Thrift thrift-compiler - code generator/compiler for Thrift definitions Changes: thrift (0.24.0-1) experimental; urgency=medium . * New major upstream release: - fixes CVE-2026-41608: unbounded zlib decompression in Python THeaderTransport(), - fixes CVE-2026-43871: TCompactProtocol() varint byte-count limit, - fixes CVE-2026-45112: unbounded read leading to denial of service, - fixes CVE-2026-48144: c_glib TLS client missing hostname verification, - fixes CVE-2026-48145: C++ TSSLSocket matchName() RFC 6125 wildcard bypass, - fixes CVE-2026-48586: TZlibTransport decompression size limit, - fixes CVE-2026-49158: Ruby THeaderTransport() zlib decompression bomb, - fixes CVE-2026-55968: Node.js quadratic-time DoS in server receive transports, - fixes CVE-2026-55969: integer overflow in TProtocol::checkReadBytesAvailable(), - fixes CVE-2026-55970: C++ heap out of bounds read in THeaderTransport::readHeaderFormat(), - fixes CVE-2026-58023: c_glib heap out-of-bounds read in transport leftover-bytes path, - fixes CVE-2026-55971: C++ zlib heap buffer overflow (write) in THeaderTransport::untransform(), - fixes CVE-2026-58389: Rust binary protocol non-strict path missing string size limit, - fixes CVE-2026-58662: C++ THeaderTransport::readString() info-header length bounds bypass, - fixes CVE-2026-66053: Python TSSLSocket hostname matcher import. * Update patches. * Rename related packages to -0.24.0 suffix. * Update copyright file. Checksums-Sha1: b5a241c5af16f0f1019dc93dd9dd8552afc3878e 3068 thrift_0.24.0-1.dsc 9fa62625ef663adafe4faea36e45acd6ffdbe727 4640299 thrift_0.24.0.orig.tar.gz 9b5288ab1f2fcbf848101c40a7d8cb6d298f8ed2 713 thrift_0.24.0.orig.tar.gz.asc 52a54326ac4a72b65e4b48bef80e571c0bbf121f 21900 thrift_0.24.0-1.debian.tar.xz 765ab6888af43db595d2ea60e40fb6a307379fe9 195392 golang-thrift-dev_0.24.0-1_all.deb e16192477403bf83f589c6e0c74d96be80df20bc 3693068 libthrift-0.24.0-dbgsym_0.24.0-1_amd64.deb dec2e1ea14b442ac90b7115db1ace9b5ee578ded 402624 libthrift-0.24.0_0.24.0-1_amd64.deb 53839b2f849154efb47efd872519807ca3970f6b 181852 libthrift-c-glib-dev_0.24.0-1_amd64.deb 2878c90db53e399bc76e47e4c7729b04b9b63794 148908 libthrift-c-glib0t64-dbgsym_0.24.0-1_amd64.deb fc58341baeb5ba211390fb16505eeff0939aabaf 161880 libthrift-c-glib0t64_0.24.0-1_amd64.deb a38e27b671fe573b226491fe856f67542d1e4f8b 561748 libthrift-dev_0.24.0-1_amd64.deb c4b9cd027638707aaf0ac4c75a88a8fdcf307d02 131876 libthrift-perl_0.24.0-1_all.deb 43741df3cd256259e6b915ea169812026688694d 89456 php-thrift-dbgsym_0.24.0-1_amd64.deb fa066677c05c36eb986f4e826309c87ec8812237 162212 php-thrift_0.24.0-1_amd64.deb 328d6ca20e0b71279ce0376079742cc00a89c1bd 316980 python3-thrift-dbgsym_0.24.0-1_amd64.deb 7b9a7f3436c64fbcb349b4be88c423c1737059a1 189520 python3-thrift_0.24.0-1_amd64.deb 6423a5198889cf09deef664f137e7568ed009eec 23843420 thrift-compiler-dbgsym_0.24.0-1_amd64.deb 78eb206033a39d5a1b521be0ee65cd798a329cf4 1555576 thrift-compiler_0.24.0-1_amd64.deb 00d823a747cd369d059a2b85a7f190a5abcda0e0 20877 thrift_0.24.0-1_amd64.buildinfo Checksums-Sha256: 93d5b4637cd8f72be22d5024aa1a70a04e042ab2e7c352e4b9b959cf362ff66f 3068 thrift_0.24.0-1.dsc e0fa5839a4c5c1d631b0931cf2c554ebbfa4e2fee3a9fb3ffd4f82ce4396c6e4 4640299 thrift_0.24.0.orig.tar.gz 0680a16fe3fc74da9f82c1d896c18d027b8b3a9e4a9b07e6400b6f79740e6fa5 713 thrift_0.24.0.orig.tar.gz.asc ebc360f3144d764fb74e3ef3d4d540daff5fa9d084c1c70712d9e8343f7e5ad0 21900 thrift_0.24.0-1.debian.tar.xz e2cdd65f58a07344fa27201e12c08c5cfdfadebb0faa542d099eddcf4f1e090c 195392 golang-thrift-dev_0.24.0-1_all.deb 3ad34fcdbe987eacadb35579912c5378d3f2df9d556014b864b3035d7719932d 3693068 libthrift-0.24.0-dbgsym_0.24.0-1_amd64.deb 7424c2e496fd43c908935634482b992fb8acbcb59ce53844e876e39d7cf27f9d 402624 libthrift-0.24.0_0.24.0-1_amd64.deb 05aeea1069dcb845c0b152728a993aeba975e17d2bfcd7004feaad34bafe7b13 181852 libthrift-c-glib-dev_0.24.0-1_amd64.deb 46c24b4dea1b59cc513fada90d3c1f9cf36dc2a78608839bef381bb666b1df1d 148908 libthrift-c-glib0t64-dbgsym_0.24.0-1_amd64.deb 2746650b5d28aa9b9c6342999e63bfe1043b8974816e1bbf50c096f8794f591d 161880 libthrift-c-glib0t64_0.24.0-1_amd64.deb 86406abb705cdb91eede3aec5f5b4860b1a8213d9888e929c1f539ff6386abe5 561748 libthrift-dev_0.24.0-1_amd64.deb e15538d13e6d026b27e8f64838dc4db38a9c2634bb58d401add062137f65b0da 131876 libthrift-perl_0.24.0-1_all.deb 8fc210c1904efb8d79f95bba521b6977e4eeaa3e51f11c967af5dcc5433fa165 89456 php-thrift-dbgsym_0.24.0-1_amd64.deb a7a2a58fbf75d784c1d3df1ad31f3f497620bdd2497c5cce437d21d2b944d2dd 162212 php-thrift_0.24.0-1_amd64.deb 75efcb1677266cb95a5eec58b49c836847ffde6175d32feb5bafbe425be539db 316980 python3-thrift-dbgsym_0.24.0-1_amd64.deb 3b35bafc9413e33a4523b015440371406d2cbfaf6d98e825c52b8435623185c9 189520 python3-thrift_0.24.0-1_amd64.deb 55a16bfa6d30695bc0c78a3dffd3343701509eaee30c194b33547eb8de3ae7be 23843420 thrift-compiler-dbgsym_0.24.0-1_amd64.deb b01643e390312d7d4e3aad8e2e10f97d1863f0431b3f59ff202bc73061ed0be0 1555576 thrift-compiler_0.24.0-1_amd64.deb dc713fb80211ca12835ac2df482e843abaed552d3398a2d3bc0e85d61adfd1ee 20877 thrift_0.24.0-1_amd64.buildinfo Files: 67e703a2e9fa4899cd08c2b7b87d7c9e 3068 devel optional thrift_0.24.0-1.dsc 232e035ff80c5fb4b7243f0be3a76b02 4640299 devel optional thrift_0.24.0.orig.tar.gz 28292f293b6d0e4b8735cc461667a7f2 713 devel optional thrift_0.24.0.orig.tar.gz.asc 311a91c290f696a420bec5c5091923b7 21900 devel optional thrift_0.24.0-1.debian.tar.xz ce2845a8cba07f6cd71d727c6a6bafd2 195392 devel optional golang-thrift-dev_0.24.0-1_all.deb 49f9545ddc00749d2b74344417f69ef0 3693068 debug optional libthrift-0.24.0-dbgsym_0.24.0-1_amd64.deb a9155454f7d209c3a76ea2f1ecce691f 402624 libs optional libthrift-0.24.0_0.24.0-1_amd64.deb b475ca1b050e494b1cf8ec18d9d43e45 181852 libdevel optional libthrift-c-glib-dev_0.24.0-1_amd64.deb c3da8de9e211c1c9f6b76f81d9352845 148908 debug optional libthrift-c-glib0t64-dbgsym_0.24.0-1_amd64.deb 26f604bfe92b206b05d6f8722834ebcf 161880 libs optional libthrift-c-glib0t64_0.24.0-1_amd64.deb 2cf6fd8c9d97ecf183a301d87786298d 561748 libdevel optional libthrift-dev_0.24.0-1_amd64.deb 5a6bd2444dfc91d84b27a62384231e8d 131876 perl optional libthrift-perl_0.24.0-1_all.deb f3b8905bc73d4bd301ed9b2859d718e4 89456 debug optional php-thrift-dbgsym_0.24.0-1_amd64.deb 4d4d912d8a2c1cedfa7320fcfa9395f0 162212 php optional php-thrift_0.24.0-1_amd64.deb f9a24b467963ffddd8f1c18421f2e35b 316980 debug optional python3-thrift-dbgsym_0.24.0-1_amd64.deb 23f6e876a4bef25faf894fe3c3600c2c 189520 python optional python3-thrift_0.24.0-1_amd64.deb 2fc3a98e96fa9452fbb357343c3fb488 23843420 debug optional thrift-compiler-dbgsym_0.24.0-1_amd64.deb 6006d2fcdce8c77ed1ec2dca0814b590 1555576 devel optional thrift-compiler_0.24.0-1_amd64.deb 8236ace01fca7b13af38734e635a3784 20877 devel optional thrift_0.24.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmpluYEACgkQ3OMQ54ZM yL8RTRAAjJHOiGbjPqwFJ6uE0xIHcZPmSwC2FbLNWMzThU3KNxmsTu0/yFq5G859 tz86XKjb+iRbJnZmqyPWaJrY1ykB+OOUsZiHRBEHVHf0s1VQ9fu+i3MHU+l9igGj bNHiAhVwJLTdouXKJTpKsyYCD48F7ahlTAv+VCbGd/KI6wrLdTn4KLQN9rOze8qP gp5K174z/uJl5gkCF30bCqvSLwN0tm3uas1WtPnU0LXbh9Ltg20jJJxPckG2vWjM Xi1osmJe4ZLNaeyyuYNRugpexLqVy8sqoYODDlxKpq6YSul1t01Yyx6lsCp8pRml 1RQsCrM95fnjIfOZYPMKrD/Bqw08Q7HH5ViqpKQZJpywfoNdwFIiH/h+2kzP7phX RrwGaXQQowMg7YxoOtLA8Gb/G4IzQJPTHzfklZlNJ4WB+wYPMa9ngLhhIQ4AVbZn b07uQdO1zBIkjG16LUz1sIrnX5lpfH4/i0Avqg4zAby28surHFmR3VgNDzKWsYce AH0x/5+OqI2Hbm1EmMhL8Pq31drvd04a7OnHQN5JWzFYt4Kg+wiiK1dqsWG5GUY0 G/wDJ2KXzG2wPQl4eXhCkrCe3P+xT6BAoHLtIG2+M96EDX0MpIa3KOVyyQnj7FxY 2nE/S0GeAwtms+yXXNH35Yv4TwwRKaf/zpFyeh5kf0a6lzol6/E= =uc9g -----END PGP SIGNATURE-----
pgp6ogCpUgtSh.pgp
Description: PGP signature
