[Git][security-tracker-team/security-tracker][master] Add Debian bug references for thrift issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 6 20:20:07 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
753be26d by Salvatore Bonaccorso at 2026-10-06T21:17:51+02:00
Add Debian bug references for thrift issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3440,17 +3440,17 @@ CVE-2026-96292 (Inefficient regular expression complexity, Inefficient Algorithm
NOTE: https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn
NOTE: lua bindings not built in Debian
CVE-2026-96289 (Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8
CVE-2026-96288 (Uncontrolled Recursion, Allocation of resources without limits or thro ...)
- thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzb
NOTE: Erlang bindings not built in Debian
CVE-2026-96287 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9
CVE-2026-96286 (Uncaught exception vulnerability in Apache Thrift Perl bindings. Th ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9
CVE-2026-96277 (Uncaught exception, Improper Handling of Exceptional Conditions vulner ...)
- thrift <unfixed> (unimportant)
@@ -3485,19 +3485,19 @@ CVE-2026-94655 (Allocation of resources without limits or throttling, Inefficien
NOTE: https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt
NOTE: lua bindings not built in Debian
CVE-2026-94654 (Loop with unreachable exit condition ('infinite loop') vulnerability i ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7j
CVE-2026-94653 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4m
CVE-2026-94652 (Missing release of memory after effective lifetime vulnerability in Ap ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727
CVE-2026-94651 (improper handling of exceptional conditions, Missing release of resour ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/rflzpdvtk8yhpzg99wkf5yf277nn7267
CVE-2026-94650 (Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/poskkt3p754b2f293g63934hw160o86j
CVE-2026-94648 (Allocation of resources without limits or throttling vulnerability in ...)
- thrift <unfixed> (unimportant)
@@ -3512,29 +3512,29 @@ CVE-2026-94645 (Improper validation of specified quantity in input, Allocation o
NOTE: https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6
NOTE: nodejs bindings not built
CVE-2026-94644 (Allocation of resources without limits or throttling vulnerability in ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzq
CVE-2026-94642 (Uncaught exception vulnerability in Apache Thrift PHP bindings. Thi ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/5tjwbbyympbj16lblocv9b12s32sg113
CVE-2026-94639 (improper handling of exceptional conditions, Allocation of resources w ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/5okpz47dv8hy0s3r6tmrplg3y7jzhhyw
CVE-2026-94638 (Allocation of resources without limits or throttling vulnerability in ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/v60w786pqr7njzz9425grby8yjrgmbsj
CVE-2026-94637 (Improper handling of highly compressed data (data amplification) vulne ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/6hxll1jcnod9gfr225tz7my08lpj3jmt
CVE-2026-94636 (Improper handling of highly compressed data (data amplification), Func ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs
CVE-2026-94635 (Allocation of resources without limits or throttling, Improper handlin ...)
- thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3
NOTE: lua bindings not built in Debian
CVE-2026-94634 (Allocation of resources without limits or throttling, Initialization o ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4
CVE-2026-94633 (Memory allocation with excessive size value, Improper handling of leng ...)
- thrift <unfixed> (unimportant)
@@ -3561,10 +3561,10 @@ CVE-2026-94405 (Authorization Bypass Through User-Controlled Key vulnerability i
CVE-2026-94180 (Authorization Bypass Through User-Controlled Key vulnerability in Mone ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93926 (Missing release of memory after effective lifetime, Missing release of ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb
CVE-2026-93925 (Stack-based buffer overflow, Incorrect bitwise shift of integer vulner ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9
CVE-2026-93880 (The Greenshift \u2013 animation and page builder blocks plugin for Wor ...)
NOT-FOR-US: WordPress plugin
@@ -3573,15 +3573,15 @@ CVE-2026-93875 (The JetAppointment plugin for WordPress is vulnerable to Stored
CVE-2026-93756 (The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for Word ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92834 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0
CVE-2026-91784 (cjbassi/gotop is vulnerable to local argument injection via process te ...)
- gotop <itp> (bug #921276)
CVE-2026-91137 (Improper validation of specified quantity in input, Allocation of reso ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7
CVE-2026-91135 (Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderT ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/rbpwlhlxnv2qgyk8cfscp2d2fd3p0ojb
CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway compone ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
@@ -3611,7 +3611,7 @@ CVE-2026-86326 (An improper verification of cryptographic signature vulnerabilit
CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol gateway ...)
NOT-FOR-US: Moxa
CVE-2026-85494 (Improper handling of length parameter inconsistency, Uncaught exceptio ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr
CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME ...)
- thrift <unfixed> (unimportant)
@@ -3620,39 +3620,39 @@ CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and J
CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffi ...)
NOT-FOR-US: WordPress plugin
CVE-2026-85483 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfy
CVE-2026-85476 (Loop with unreachable exit condition ('infinite loop') vulnerability i ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jj
CVE-2026-85215 (Improper neutralization of special elements used in an SQL command ('S ...)
NOT-FOR-US: Paperwork
CVE-2026-85209 (Missing Authorization vulnerability in AVEZ Electronics Communication ...)
NOT-FOR-US: AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS)
CVE-2026-85088 (Improper Validation of Certificate with Host Mismatch in the C++ and D ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371
CVE-2026-85087 (Improper certificate validation, Return of wrong status code vulnerabi ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0d
CVE-2026-85086 (Improper certificate validation, Initialization of a resource with an ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy
CVE-2026-83745 (Memory allocation with excessive size value, Improper handling of leng ...)
- thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc
NOTE: nodejs/D bindings not built
CVE-2026-83663 (Uncontrolled Recursion vulnerability in Apache Thrift go bindings. ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct
CVE-2026-83632 (Allocation of resources without limits or throttling, Integer overflow ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/zjv6hjmhl4tb4l4l1dk4bmc2whxh0lb4
CVE-2026-82459 (Integer underflow (wrap or wraparound), Out-of-bounds write vulnerabil ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2
CVE-2026-82458 (Memory allocation with excessive size value, Allocation of resources w ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7
CVE-2026-80464 (Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef ...)
NOT-FOR-US: Sef AI Chatbot Platform
@@ -3665,31 +3665,31 @@ CVE-2026-80298 (Improper neutralization of special elements used in an SQL comma
CVE-2026-67989 (crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
NOT-FOR-US: crmne/ruby_llm
CVE-2026-66859 (NULL Pointer Dereference, Use of Uninitialized Variable vulnerability ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o
CVE-2026-66858 (The protocol skip routine in several Apache Thrift bindings did not ap ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5
CVE-2026-66837 (Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerabil ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1
CVE-2026-66331 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- thrift <unfixed> (unimportant)
NOTE: https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143
NOTE: Delphin bindings not built
CVE-2026-66081 (Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57
CVE-2026-66055 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx
CVE-2026-66054 (Allocation of Resources Without Limits or Throttling, Improper Handlin ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33
CVE-2026-64818
REJECTED
CVE-2026-63772 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/6kpzdw29gsfxptv4b65y9s6f42tdyo8k
CVE-2026-63578 (Allocation of resources without limits in password-based private-key d ...)
NOT-FOR-US: Bouncy Castle bc-csharp
@@ -3710,10 +3710,10 @@ CVE-2026-63571 (Improper verification of cryptographic signature in the attribut
CVE-2026-63570 (Loop with unreachable exit condition in Pkcs12Store.GetCertificateChai ...)
NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-61374 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/35831rngzrqky1gvc32t06psgq1b8441
CVE-2026-61373 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- - thrift <unfixed>
+ - thrift <unfixed> (bug #1150191)
NOTE: https://lists.apache.org/thread/shy1rrm2g383wlbdb2p7w19c868ntdjp
CVE-2026-5782 (Improper neutralization of input during web page generation ('cross-si ...)
NOT-FOR-US: TurkHotspot
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/753be26dd3dcb1c913f4312b5699f70ee9920565
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/753be26dd3dcb1c913f4312b5699f70ee9920565
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/b1551d7b/attachment.htm>
More information about the debian-security-tracker-commits
mailing list