[Git][security-tracker-team/security-tracker][master] Add new batch of thrift issues

Salvatore Bonaccorso (@carnil) carnil at debian.org
Tue Jul 28 10:09:54 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7dc875ab by Salvatore Bonaccorso at 2026-07-28T11:09:30+02:00
Add new batch of thrift issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -739,9 +739,11 @@ CVE-2026-59250 (Classic buffer overflow in the Erlang/OTP megaco flex scanner C
 CVE-2026-59239 (Stored Cross-site Scripting (CWE-79) in the email module in Roskus Pro ...)
 	NOT-FOR-US: Roskus Prospero Flow CRM
 CVE-2026-58662 (Improper Validation of Specified Quantity in Input, Out-of-bounds Read ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/13mzvylr3r3nktxrh5k1h30ng1t1sw1d
 CVE-2026-58389 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/ht2mjt8m3vz9v0h5pqzvc4r4nzfxwtrw
 CVE-2026-58227 (The Erlang/OTP ssl application does not detect cycles when reconstruct ...)
 	- erlang <unfixed>
 	NOTE: https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw
@@ -751,7 +753,8 @@ CVE-2026-58227 (The Erlang/OTP ssl application does not detect cycles when recon
 	NOTE: Fixed by: https://github.com/erlang/otp/commit/241d43703989fec4b6bf637beaeb366d92dcc4c2 (OTP-28.5.0.4)
 	NOTE: Fixed by: https://github.com/erlang/otp/commit/7db64720177961e04545681480d691c4be81c54d (OTP-29.0.4)
 CVE-2026-58023 (Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings.  Th ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/z2myopbovxngfvchdz8hddots9p5ffbt
 CVE-2026-57917 (proCertum SmartSignparses external XML entities from arbitrary crafted ...)
 	NOT-FOR-US: proCertum SmartSign
 CVE-2026-57916 (proCertum SmartSign opens Certificate Practice Statement (CPS) URI wit ...)
@@ -761,13 +764,17 @@ CVE-2026-56538 (An endpoint in HCL Connections is vulnerable to information disc
 CVE-2026-56537 (HCL Connections is vulnerable to information disclosure which could al ...)
 	NOT-FOR-US: HCL
 CVE-2026-55971 (Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/xjs36m6kjxpmrmzwck636msg3nvoqnmx
 CVE-2026-55970 (Buffer Over-read vulnerability in Apache Thrift C++ bindings.  This is ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/8pbnw4dyxxc9opp6qq725jhrzg25v8q7
 CVE-2026-55969 (Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_g ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo
 CVE-2026-55968 (Inefficient Algorithmic Complexity, Allocation of Resources Without Li ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/gxhhfyr6flr5vzr4qnxm13p6fc41qstp
 CVE-2026-55953 (The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not veri ...)
 	- erlang <unfixed>
 	NOTE: https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882
@@ -824,13 +831,17 @@ CVE-2026-51244 (schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerab
 CVE-2026-51235 (LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function ...)
 	TODO: check
 CVE-2026-49158 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/fmjl8l415tj9zwlob8v2dr5hq1d0hts7
 CVE-2026-48586 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq
 CVE-2026-48145 (Improper Validation of Certificate with Host Mismatch vulnerability in ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/2popgc4ks1l87jjho1w5fpk5k4x06b7h
 CVE-2026-48144 (Improper Validation of Certificate with Host Mismatch vulnerability in ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/2xoltfxgzf5jyhcwq6y07spts5cn6ppj
 CVE-2026-48052 (Papra is a minimalistic document management and archiving platform. Pr ...)
 	NOT-FOR-US: Papra
 CVE-2026-48051 (Papra is a minimalistic document management and archiving platform. Pr ...)
@@ -852,9 +863,11 @@ CVE-2026-45623 (PostCSS takes a CSS file and provides an API to analyze and modi
 	NOTE: https://github.com/postcss/postcss/commit/94484cae6d4308167939f2ac888d166bd80dff01 (8.5.12)
 	NOTE: https://github.com/postcss/postcss/commit/85c4d7dab830be366f8a96047f9e5b7944e101d8 (8.5.12)
 CVE-2026-45112 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/hl9kmf1z2o3lxvspoj3g9ykl8lj9mdxc
 CVE-2026-43871 (Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability i ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby
 CVE-2026-42792 (Improper Handling of Exceptional Conditions vulnerability in Erlang OT ...)
 	- erlang <unfixed>
 	NOTE: https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6
@@ -862,7 +875,8 @@ CVE-2026-42792 (Improper Handling of Exceptional Conditions vulnerability in Erl
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-42792
 	NOTE: Fixed by; https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb (OTP-29.0.4, OTP-28.5.0.4, OTP-27.3.4.15)
 CVE-2026-41608 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
 CVE-2026-40000 (The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity wit ...)
 	NOT-FOR-US: ZTE
 CVE-2026-24252 (NVIDIA NeMo for Linux contains a vulnerability where an attacker may c ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dc875ab452062a6b6ce10eb3411934e23eed563

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dc875ab452062a6b6ce10eb3411934e23eed563
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260728/67068074/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list