Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
68a99a7d by Moritz Muehlenhoff at 2026-10-03T00:31:59+02:00
thrift triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -129,14 +129,16 @@ CVE-2026-94636 (Improper handling of highly compressed
data (data amplification)
- thrift <unfixed>
NOTE: https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs
CVE-2026-94635 (Allocation of resources without limits or throttling, Improper
handlin ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3
+ NOTE: lua bindings not built in Debian
CVE-2026-94634 (Allocation of resources without limits or throttling,
Initialization o ...)
- thrift <unfixed>
NOTE: https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4
CVE-2026-94633 (Memory allocation with excessive size value, Improper handling
of leng ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k
+ NOTE: dart bindings not built
CVE-2026-94544 (Next.js is a React framework for building full-stack web
applications. ...)
NOT-FOR-US: Next.js
CVE-2026-94543 (Next.js is a React framework for building full-stack web
applications. ...)
@@ -183,22 +185,26 @@ CVE-2026-91135 (Heap-based buffer overflow vulnerability
in Apache Thrift C++ TH
CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway
compone ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
CVE-2026-90440 (Uncaught exception, improper handling of exceptional
conditions, impro ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg
+ NOTE: D bindings not built
CVE-2026-87920 (The W3 Total Cache plugin for WordPress is vulnerable to
Stored Cross- ...)
NOT-FOR-US: WordPress plugin
CVE-2026-87117 (NULL pointer dereference vulnerability in Apache Thrift PHP
bindings. ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy
CVE-2026-86537 (Uncaught exception, Loop with unreachable exit condition
('infinite lo ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m
+ NOTE: D bindings not built
CVE-2026-86536 (Improperly controlled modification of object prototype
attributes ('pr ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp
+ NOTE: javascript bindings not built
CVE-2026-86535 (Loop with unreachable exit condition ('infinite loop'),
Improperly con ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g
+ NOTE: nodejs bindings not built
CVE-2026-86326 (An improper verification of cryptographic signature
vulnerability exis ...)
NOT-FOR-US: Moxa
CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol
gateway ...)
@@ -207,7 +213,8 @@ CVE-2026-85494 (Improper handling of length parameter
inconsistency, Uncaught ex
- thrift <unfixed>
NOTE: https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr
CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and
Java ME ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
+ NOTE: dart/JavaME (different from Java) bindings not built
NOTE: https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m
CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings
& Traffi ...)
NOT-FOR-US: WordPress plugin
@@ -231,8 +238,9 @@ CVE-2026-85086 (Improper certificate validation,
Initialization of a resource wi
- thrift <unfixed>
NOTE: https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy
CVE-2026-83745 (Memory allocation with excessive size value, Improper handling
of leng ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc
+ NOTE: nodejs/D bindings not built
CVE-2026-83663 (Uncontrolled Recursion vulnerability in Apache Thrift go
bindings. ...)
- thrift <unfixed>
NOTE: https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct
@@ -265,8 +273,9 @@ CVE-2026-66837 (Stack-based Buffer Overflow, Integer
Overflow or Wraparound vuln
- thrift <unfixed>
NOTE: https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1
CVE-2026-66331 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- - thrift <unfixed>
+ - thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143
+ NOTE: Delphin bindings not built
CVE-2026-66081 (Access of Uninitialized Pointer vulnerability in Apache Thrift
c_glib ...)
- thrift <unfixed>
NOTE: https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68a99a7d37bd5f316609c3c1d92196acdc074aa8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68a99a7d37bd5f316609c3c1d92196acdc074aa8
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
