[Git][security-tracker-team/security-tracker][master] initial thrift triage

Moritz Muehlenhoff (@jmm) jmm at debian.org
Fri Oct 2 22:25:04 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
62db517a by Moritz Muehlenhoff at 2026-10-02T23:24:33+02:00
initial thrift triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -15,8 +15,9 @@ CVE-2026-97338 (The Download Manager plugin for WordPress is vulnerable to Store
 CVE-2026-97336 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scrip ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-96990 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh
+	NOTE: Erlang bindings not built in Debian
 CVE-2026-96940 (Weak authorization in Microsoft Exchange Server allows an authenticate ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-96871 (The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site ...)
@@ -32,17 +33,20 @@ CVE-2026-96567 (The MW WP Form plugin for WordPress is vulnerable to Stored Cros
 CVE-2026-96566 (The Newsletter \u2013 Send awesome emails from WordPress plugin for Wo ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-96294 (Uncaught exception, Improper Handling of Exceptional Conditions vulner ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4
+	NOTE: nodejs bindings not built in Debian
 CVE-2026-96292 (Inefficient regular expression complexity, Inefficient Algorithmic Com ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn
+	NOTE: lua bindings not built in Debian
 CVE-2026-96289 (Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings.    ...)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8
 CVE-2026-96288 (Uncontrolled Recursion, Allocation of resources without limits or thro ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzb
+	NOTE: Erlang bindings not built in Debian
 CVE-2026-96287 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl ...)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9
@@ -50,8 +54,9 @@ CVE-2026-96286 (Uncaught exception vulnerability in Apache Thrift Perl bindings.
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9
 CVE-2026-96277 (Uncaught exception, Improper Handling of Exceptional Conditions vulner ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/k1t5r9sz7k5tn57cnf5khw2ywlxv6098
+	NOTE: Ruby bindings not built in Debian
 CVE-2026-95817 (The DoFollow Case by Case plugin for WordPress is vulnerable to Stored ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-95670 (The No External Links plugin for WordPress is vulnerable to Stored Cro ...)
@@ -63,17 +68,21 @@ CVE-2026-95512 (A flaw was found in FreeType, specifically within its CID font l
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462295
 	NOTE: Fixed by: https://gitlab.freedesktop.org/freetype/freetype/-/commit/f3ca71c9900fe860849b3163a6e2c1e765b291d9
 CVE-2026-94658 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua  ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/hv6b1nyk2p15gy5pmtprwo7z9m46mfcx
+	NOTE: lua bindings not built in Debian
 CVE-2026-94657 (Allocation of resources without limits or throttling vulnerability in  ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14
+	NOTE: JavaME bindings not built in Debian (different from standard Java bindings)
 CVE-2026-94656 (Allocation of resources without limits or throttling vulnerability in  ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8
+	NOTE: Ruby bindings not built in Debian
 CVE-2026-94655 (Allocation of resources without limits or throttling, Inefficient Algo ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt
+	NOTE: lua bindings not built in Debian
 CVE-2026-94654 (Loop with unreachable exit condition ('infinite loop') vulnerability i ...)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7j
@@ -90,14 +99,17 @@ CVE-2026-94650 (Uncontrolled Recursion vulnerability in Apache Thrift c_glib bin
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/poskkt3p754b2f293g63934hw160o86j
 CVE-2026-94648 (Allocation of resources without limits or throttling vulnerability in  ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/f9w4q6ttlc3k9404x4do25gdhqodtjnn
+	NOTE: dart bindings not built
 CVE-2026-94646 (Uncaught exception, Improper validation of specified quantity in input ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8
+	NOTE: nodejs bindings not built
 CVE-2026-94645 (Improper validation of specified quantity in input, Allocation of reso ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6
+	NOTE: nodejs bindings not built
 CVE-2026-94644 (Allocation of resources without limits or throttling vulnerability in  ...)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzq



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62db517a5535478eb844bf3b058cdd34e381be50

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62db517a5535478eb844bf3b058cdd34e381be50
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/58fb57e7/attachment.htm>

More information about the debian-security-tracker-commits mailing list