Security Advisory catalog CVE-2026-43871 CVE-2026-43871 Published
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit Overview Affected History Connections
cve-program · CVE-2026-43871 Published thrift https://pypi.python.org
Original vendor version evidence · not evaluated as a NuGet range {
"collectionURL": "https://pypi.python.org",
"defaultStatus": "unaffected",
"packageName": "thrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
} github.com/apache/thrift https://proxy.golang.org
Original vendor version evidence · not evaluated as a NuGet range {
"collectionURL": "https://proxy.golang.org",
"defaultStatus": "unaffected",
"packageName": "github.com/apache/thrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
} apache/thrift https://packagist.org
Original vendor version evidence · not evaluated as a NuGet range {
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "apache/thrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
} org.apache.thrift:libthrift https://repo.maven.apache.org/maven2
Original vendor version evidence · not evaluated as a NuGet range {
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.thrift:libthrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
nvd · CVE-2026-43871 Published No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.
osv · GHSA-8wv5-x4w7-5gww Published thrift PyPI
ECOSYSTEM · introduced 0 → fixed 0.24.0
17 explicitly affected versions 0.10.0, 0.11.0, 0.13.0, 0.14.0, 0.14.1, 0.14.2, 0.15.0, 0.16.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.8.0, 0.9.0, 0.9.1, 0.9.2, 0.9.3
github.com/apache/thrift Go
SEMVER · introduced 0 → fixed 0.24.0
apache/thrift Packagist
ECOSYSTEM · introduced 0 → fixed 0.24.0
21 explicitly affected versions 0.10.0, 0.11.0, 0.9.0, 0.9.2, 0.9.3, 0.9.3.1, v0.12.0, v0.13.0, v0.14.0, v0.14.1, v0.14.2, v0.15.0, v0.16.0, v0.17.0, v0.18.0, v0.18.1, v0.19.0, v0.20.0, v0.21.0, v0.22.0, v0.23.0
org.apache.thrift:libthrift Maven
ECOSYSTEM · introduced 0 → fixed 0.24.0
25 explicitly affected versions 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.14.1, 0.14.2, 0.15.0, 0.16.0, 0.17.0, 0.18.0, 0.18.1, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.6.1, 0.7.0, 0.8.0, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.3-1