Security Advisory catalog CVE-2026-66055 Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory .
cve-program · CVE-2026-66055 Published
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-66055 Published thrift https://conan.io/center
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"packageURL": "pkg:conan/thrift",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.25.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://conan.io/center",
"packageName": "thrift"
} org.apache.thrift:libthrift https://repo.maven.apache.org/maven2
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"packageURL": "pkg:maven/org.apache.thrift/libthrift",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.25.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.thrift:libthrift"
} github.com/apache/thrift https://golang.org/pkg
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"packageURL": "pkg:golang/github.com/apache/thrift",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.25.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://golang.org/pkg",
"packageName": "github.com/apache/thrift"
} ApacheThrift NuGet
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"packageURL": "pkg:nuget/ApacheThrift",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.25.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://nuget.org/packages",
"packageName": "ApacheThrift"
} thrift https://pypi.python.org
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"packageURL": "pkg:pypi/thrift",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.25.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://pypi.python.org",
"packageName": "thrift"
} delphi bindings Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"packageName": "delphi bindings",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.25.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
} Original source record · Cite this exact observation · Complete original publisher JSON