Posted by Jens Geyer on Oct 30 Severity: important CVSS 4.0: 8.2 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache Thrift (org.apache.thrift:libthrift) before 0.24.0 Description: Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/456
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
Posted by Yash Mayya on Oct 30 Severity: moderate Affected versions: - Apache Pinot 0.7.0 before 1.6.0 Description: Incorrect Authorization vulnerability in the…
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
Posted by Terence Monteiro on Oct 29 Severity: important Affected versions: - Apache Fineract through 1.15.0 Description: Improper Neutralization of Special Elements…
Multiple vulnerabilities in Suricata before 8.0.8
Posted by Victor Julien on Oct 29 Suricata 8.0.8 was released addressing a number of vulnerabilities. - HIGH: tftp: unbounded transaction retention can cause CPU…
Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’
The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites…
The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO
The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites…
CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
Posted by Manikumar on Oct 28 Severity: low Affected versions: - Apache Kafka 2.4.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Apache Kafka Connect…