[Git][security-tracker-team/security-tracker][master] Add another batch of thirft issues (need assessment for built bindings)

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
604dad14 by Salvatore Bonaccorso at 2026-10-02T22:52:24+02:00
Add another batch of thirft issues (need assessment for built bindings)

Just adding the first batch of new thift issues, but this need
sassessment which of the bindings are built and which are not provided
in a binary package.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -244,23 +244,31 @@ CVE-2026-80298 (Improper neutralization of special elements used in an SQL comma
 CVE-2026-67989 (crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
 	NOT-FOR-US: crmne/ruby_llm
 CVE-2026-66859 (NULL Pointer Dereference, Use of Uninitialized Variable vulnerability  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o
 CVE-2026-66858 (The protocol skip routine in several Apache Thrift bindings did not ap ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5
 CVE-2026-66837 (Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerabil ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1
 CVE-2026-66331 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143
 CVE-2026-66081 (Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57
 CVE-2026-66055 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx
 CVE-2026-66054 (Allocation of Resources Without Limits or Throttling, Improper Handlin ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33
 CVE-2026-64818
 	REJECTED
 CVE-2026-63772 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/6kpzdw29gsfxptv4b65y9s6f42tdyo8k
 CVE-2026-63578 (Allocation of resources without limits in password-based private-key d ...)
 	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63577 (Improper certificate validation in the directoryName name-constraint c ...)
@@ -280,9 +288,11 @@ CVE-2026-63571 (Improper verification of cryptographic signature in the attribut
 CVE-2026-63570 (Loop with unreachable exit condition in Pkcs12Store.GetCertificateChai ...)
 	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-61374 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/35831rngzrqky1gvc32t06psgq1b8441
 CVE-2026-61373 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	- thrift <unfixed>
+	NOTE: https://lists.apache.org/thread/shy1rrm2g383wlbdb2p7w19c868ntdjp
 CVE-2026-5782 (Improper neutralization of input during web page generation ('cross-si ...)
 	NOT-FOR-US: TurkHotspot
 CVE-2026-59673 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/604dad1498aac0ef54077cf32750af9f08ffdb52

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/604dad1498aac0ef54077cf32750af9f08ffdb52
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/da784894/attachment.htm>