[Git][security-tracker-team/security-tracker][master] thrift triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
68a99a7d by Moritz Muehlenhoff at 2026-10-03T00:31:59+02:00
thrift triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -129,14 +129,16 @@ CVE-2026-94636 (Improper handling of highly compressed data (data amplification)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs
 CVE-2026-94635 (Allocation of resources without limits or throttling, Improper handlin ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3
+	NOTE: lua bindings not built in Debian
 CVE-2026-94634 (Allocation of resources without limits or throttling, Initialization o ...)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4
 CVE-2026-94633 (Memory allocation with excessive size value, Improper handling of leng ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k
+	NOTE: dart bindings not built
 CVE-2026-94544 (Next.js is a React framework for building full-stack web applications. ...)
 	NOT-FOR-US: Next.js
 CVE-2026-94543 (Next.js is a React framework for building full-stack web applications. ...)
@@ -183,22 +185,26 @@ CVE-2026-91135 (Heap-based buffer overflow vulnerability in Apache Thrift C++ TH
 CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway compone ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-90440 (Uncaught exception, improper handling of exceptional conditions, impro ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg
+	NOTE: D bindings not built
 CVE-2026-87920 (The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross- ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-87117 (NULL pointer dereference vulnerability in Apache Thrift PHP bindings.  ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy
 CVE-2026-86537 (Uncaught exception, Loop with unreachable exit condition ('infinite lo ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m
+	NOTE: D bindings not built
 CVE-2026-86536 (Improperly controlled modification of object prototype attributes ('pr ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp
+	NOTE: javascript bindings not built
 CVE-2026-86535 (Loop with unreachable exit condition ('infinite loop'), Improperly con ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g
+	NOTE: nodejs bindings not built
 CVE-2026-86326 (An improper verification of cryptographic signature vulnerability exis ...)
 	NOT-FOR-US: Moxa
 CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol gateway ...)
@@ -207,7 +213,8 @@ CVE-2026-85494 (Improper handling of length parameter inconsistency, Uncaught ex
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr
 CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
+	NOTE: dart/JavaME (different from Java) bindings not built
 	NOTE: https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m
 CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffi ...)
 	NOT-FOR-US: WordPress plugin
@@ -231,8 +238,9 @@ CVE-2026-85086 (Improper certificate validation, Initialization of a resource wi
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy
 CVE-2026-83745 (Memory allocation with excessive size value, Improper handling of leng ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc
+	NOTE: nodejs/D bindings not built
 CVE-2026-83663 (Uncontrolled Recursion vulnerability in Apache Thrift go bindings.     ...)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct
@@ -265,8 +273,9 @@ CVE-2026-66837 (Stack-based Buffer Overflow, Integer Overflow or Wraparound vuln
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1
 CVE-2026-66331 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	- thrift <unfixed>
+	- thrift <unfixed> (unimportant)
 	NOTE: https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143
+	NOTE: Delphin bindings not built
 CVE-2026-66081 (Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib  ...)
 	- thrift <unfixed>
 	NOTE: https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68a99a7d37bd5f316609c3c1d92196acdc074aa8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68a99a7d37bd5f316609c3c1d92196acdc074aa8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/8c26d8dd/attachment-0001.htm>