Denial of service in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows unauthenticated remote attackers to exhaust process memory by supplying crafted OpenPGP public keys, certificates, or signatures, because a subpacket header using the five-octet (0xFF) length form declares an oversized body length that is used directly to size a buffer before any subpacket data is read. The flaw lives in SignatureSubpacketsParser.ReadPacket and UserAttributeSubpacketsParser.ReadPacket (CWE-789, memory allocation with excessive size value) and is rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) and an independently assessed CVSS 3.1 of A:H with no confidentiality or integrity impact; a handful of input bytes can demand an allocation of up to roughly 2 GB (the 32-bit length field permits up to ~4 GB in principle), so any service that imports or verifies untrusted PGP material is exposed. Vendor patches are available (bc-csharp 2.7.0) and no public exploit code has been identified at time of analysis, though the upstream regression test does illustrate the malicious packet format.
Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.
Stack exhaustion in Apache Thrift before 0.25.0 allows remote, unauthenticated attackers to crash processes that deserialize attacker-controlled Thrift messages, because the protocol skip routine in several language bindings fails to apply the binding's recursion limit when skipping unknown fields. The affected bindings are the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bug is reachable over the network with no privileges or user interaction, but the impact metrics (VC:N/VI:N/VA:H) restrict the consequence to availability loss. There is no code execution or data exposure, no public exploit code and no confirmed active exploitation at time of analysis, and Apache has released version 0.25.0 which restores the recursion limit.
Denial of service in the Legion of the Bouncy Castle C# library (bc-csharp) affects all versions before 2.7.0, where quadratic CPU work in X.509 distinguished-name string conversion lets a remote unauthenticated attacker exhaust a server's CPU with a single crafted certificate, CRL, certification request, or other DN-bearing structure containing a long attribute value of characters that require RFC 4514 escaping. Exposure requires that the application actually converts the untrusted name to a string via X509Name.ToString / IetfUtilities.ValueToString (for logging or display) or compares it with IetfUtilities.RdnAreEqual, as PKIX path validation does when enforcing directoryName name constraints; merely parsing the certificate is not enough. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but a vendor patch is available and the availability-only impact (CVSS:4.0 8.7 / assessed CVSS:3.1 7.5, A:H) makes application-level exposure the decisive risk factor.
Authentication-tag forgery in Legion of the Bouncy Castle Inc. bc-csharp (Bouncy Castle C#) before 2.7.0 lets a remote, unauthenticated attacker who can obtain ciphertext-and-tag pairs for known or chosen plaintexts under at least two nonces forge a ciphertext that passes tag verification under a nonce that was never queried, because the DSTU 7624 (Kalyna) CCM implementation (KCcmBlockCipher) skipped the nonce-binding G1 block whenever a message carried no associated data. Only applications that call KCcmBlockCipher directly with empty AAD are affected, and the impact is integrity-only (VI:H, VC:N, VA:N), consistent with the vendor's CVSS 4.0 score of 8.7 and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No public exploit was identified at time of analysis and the issue is not in CISA KEV, but the upstream fix commit publicly includes a regression test that assembles exactly such a cross-nonce forgery using three empty-AAD encryption queries, so the attack technique is documented; practical exposure is narrowed by the requirement for an encryption oracle and for empty-AAD usage of this specific mode.
Forged X.509 attribute certificates are accepted as valid by Legion of the Bouncy Castle Inc. bc-csharp versions before 2.7.0, because the PkixAttrCertPathValidator (and PkixAttrCertPathBuilder) never verifies the attribute certificate's signature against the issuer's public key. An unauthenticated remote attacker can therefore supply an attribute certificate that names a trusted attribute authority as issuer without being signed by it, and any application that grants roles or privileges based on that certificate's attributes will act on the attacker's forged claims. Only applications that use these specific classes to validate attribute certificates and derive authorization decisions from them are affected; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). The vendor has released a fix in version 2.7.0.
Unauthenticated attachment disclosure in YesWiki before 4.6.7 allows remote attackers to bypass page read ACLs and retrieve confidential files by directly invoking the attachment download handler with a known page tag and file parameter. The missing authorization check (CWE-862) yields high confidentiality impact with no integrity or availability impact, reflected in the independent CVSS 3.1 assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the CVSS 4.0 score of 8.7. No public exploit code has been identified at time of analysis, but exploitation requires only knowledge of the page tag and attachment name and works against default deployments where ACLs are the sole protection.
Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).
Missing authorization in the YesWiki tags tool (listpagestag and includepages actions) lets unauthenticated remote attackers enumerate ACL-restricted pages and read their names along with body-derived titles on any instance running YesWiki before 4.6.7. Because the CVSS 4.0 vector carries PR:N/UI:N/AC:L, no credentials, no user interaction, and no non-default configuration are needed - the affected actions simply fail to apply read-ACL filtering, so default installations are exposed whenever ACL-restricted pages exist. The leak is limited to page names and derived titles rather than full page bodies, and no public exploit code or confirmed active exploitation was identified at time of analysis, though EPSS-style urgency is tempered by the low-value, low-bandwidth nature of the disclosure.
Unauthenticated denial of service in Zebra (Zcash Foundation's full node implementation) before 6.0.0 allows remote peers to stall Tokio worker threads by submitting non-standard, high-sigop P2SH mempool transactions that reach synchronous FFI script verification before standardness checks, saturating the verifier buffer and rendering the node unresponsive. The vulnerability requires no authentication, user interaction, or non-default configuration; only reachable nodes running affected versions are impacted, and impact is limited to availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Remote unauthenticated attackers can cause a consensus divergence in Zcash Zebra nodes (zebrad 4.5.0 and zebra-script 7.0.0) by broadcasting P2SH spends that use low-threshold multisig redeem scripts, causing affected Zebra nodes to reject a block that zcashd accepts and stall off the chain, resulting in a denial of service. The vulnerability stems from incorrect signature operation counting that overcounts CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops, inflating the MAX_BLOCK_SIGOPS count. No public exploit code has been identified at time of analysis, and no authentication or user interaction is required per the CVSS vector PR:N/UI:N.
Zcash Foundation's Zebra full node (zebrad) before 6.2.1 can be stalled in block verification by any unauthenticated peer on the P2P network: an attacker pushes zero-fee V6 mempool transactions containing invalid, zero-filled Orchard and Ironwood Halo2 proofs, which drain the shared, unprioritized proof-verification queue and cause the node to fall behind the chain tip. Impact is confined to availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity loss - and exploitation requires only that the node accepts untrusted inbound peers and relays mempool transactions, i.e. its normal operating mode. No public exploit code was identified at time of analysis and the CVE is not confirmed actively exploited; the issue is a resource-amplification/denial-of-service class (CWE-405) rather than data compromise.
Block-sync denial of service in Zebra (zebrad), the Rust implementation of a Zcash full node, affects all versions before 6.3.0. During block download, a malicious peer can repeatedly serve a canonical block whose coinbase scriptSig is rewritten to claim height 1 while preserving the requested block hash - an evasion made possible because V5 transaction IDs exclude the scriptSig - causing the node to discard the block as too far behind the tip and repeatedly refetch it instead of advancing to the newest chain tip. The attacker remains unauthenticated (CVSS vector PR:N) and must simply be an accepted block-supplying peer; the flaw is an insufficient verification of data authenticity issue (CWE-345) whose impact our assessment bounds to availability only (VA:H in the CVE 4.0 score, but no confidentiality or integrity loss), so real-world severity is a sync delay rather than node compromise. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Missing authorization in the SiYuan note-taking server before 3.8.5 allows any unauthenticated visitor to a published document to read database rows that were explicitly marked password-protected or publish-disabled, by invoking the /api/export/preview endpoint against a public document that embeds a database view. Rated CVSS 4.0 8.7 (HIGH) and CWE-862, the issue is a clean remote-unauthenticated disclosure profile (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with no integrity or availability impact), so exploitation is limited to reading protected rows' primary-key text and cell values; no public exploit code has been identified at time of analysis, and the vendor has shipped 3.8.5 as the fix.
Unrestricted file upload in YesWiki before 4.6.7 lets a remote attacker who already holds an administrator account turn a crafted Bazar CSV import into server-side code execution: the import preview fetches a remote .php URL referenced in a file or image field and writes it into the web-accessible files/ directory with no extension or MIME validation, where PHP then executes it. The issue is a classic CWE-434 flaw rated CVSS 8.6 (CVSS:4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and because it requires a high-privilege account plus the Bazar component in use, it is best characterized as a privilege-escalation-to-RCE path rather than an unauthenticated remote compromise. No public exploit was identified at time of analysis, and there is no CISA KEV listing; vendor patching is available in YesWiki 4.6.7.
Authenticated Ghost administrators can obtain remote code execution by uploading a crafted theme whose translation (i18n/locale) files abuse path traversal (CWE-22) to load attacker-controlled content that the Node.js server then executes. The vulnerability affects Ghost 6.10.3 through every release before 6.64.0, and exploitation requires a full administrator account with access to the theme upload/management feature - anonymous visitors, members, authors, and editors cannot trigger it, and no end-user interaction is needed once admin rights are held. No public exploit code has been identified at time of analysis, and this is an access-gated risk rather than a drive-by threat; the vendor has shipped a fixed release, with details in advisory GHSA-jj74-hc2q-xrvm and a parallel VulnCheck advisory.
Stored cross-site scripting (XSS) in Ghost CMS 2.5.0 through 6.63.x (before 6.64.0) lets an unauthenticated attacker inject malicious scripts into post content by hosting a crafted oEmbed photo response and persuading a content editor to embed its URL. The injected script executes in the Ghost editor, on published pages, and in newsletter emails, potentially compromising staff admin sessions. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patch in Ghost 6.64.0; the issue is considered credible but not an emergency because exploitation requires user interaction and targeted social engineering.
Firmware images pushed to Moxa MGate MB3170 and MB3270 series protocol gateways are not cryptographically validated before installation, so a modified or counterfeit image is flashed with the same trust as a vendor-signed one. Exploitation requires an attacker to already hold high-privilege (administrative) access to the device's firmware update interface and to reach it over the network; once that access exists, no additional weakness is needed and no user interaction is required. Successful abuse yields code execution on the gateway plus persistence across subsequent firmware updates, but the impact is confined to the device itself rather than downstream OT systems. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. This is a genuine but access-gated integrity flaw rather than a mass-exploitation threat.
Local privilege escalation leading to code execution in Nx (Nrwl Nx) affects versions 14.6.0 through 22.7.8 and 23.1.x before 23.1.2 on macOS and Linux, where daemon and isolated plugin-worker Unix domain sockets are created in shared temporary locations such as /tmp/.nx without owner-only 0700 directory or socket permissions. Because the socket transport performs no authentication and relies entirely on filesystem containment, a second unprivileged local account on the same shared build server, developer host, or multi-user container can connect and invoke handlers - notably PROCESS_IN_BACKGROUND, which accepts a module path and invokes its default export as the account running Nx - and can also read workspace file contents, project graphs, and task hashes. The flaw is rated CVSS 4.0 8.5 (AV:L/AC:L/PR:L, CWE-269); no public exploit code was identified at time of analysis, single-user machines with no other local account are not exposed, and disabling the daemon alone does not remove the still-vulnerable plugin-worker sockets - only upgrading to 22.7.9 or 23.1.2, or enforcing owner-only socket and directory permissions, closes the exposure.
Cross-site scripting in prosemirror-view (all versions prior to 1.42.3) lets unauthenticated attackers execute arbitrary JavaScript in the browser window hosting an editor when a victim pastes attacker-crafted HTML into a ProseMirror-backed field. The root cause is in the paste path: attributes delivered through the clipboard slice context are applied without being run through the schema's attribute validators, so crafted markup can smuggle content that the schema would normally reject. Exploitation is gated by that mandatory paste action (CVSS UI:A / UI:R), so it is not triggerable without victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships in 1.42.3 as a small change that runs attribute validators on slice-context attributes.
Stored cross-site scripting in Ghost CMS (5.94.0 up to but not including 6.64.0) lets any staff account - including low-privileged Contributors - plant persistent arbitrary HTML/JavaScript in the admin panel by creating a bookmark card whose icon or thumbnail URL points to an external resource that returns a non-image file, which Ghost then fetches, stores, and re-renders to other staff. Exploitation requires an authenticated low-privileged account (CVSS PR:L, confirmed by the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) plus a higher-privileged staff user (admin or editor) passively viewing the affected card in the admin interface (UI:P), so it is an insider/multi-author risk rather than an anonymous remote attack. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; the vendor has released a fix, making this a credible medium-to-high priority patching item for multi-author Ghost instances rather than a drop-everything emergency.
Stored cross-site scripting in Ghost CMS (6.22.1 through versions before 6.64.0) allows an authenticated staff user to upload a file that the default local storage adapter serves back from the site's own origin with an extension-derived content type, so a second staff member who views the upload in the admin context can have their session compromised. The attack is privilege-gated rather than a drive-by critical: it requires an existing staff account (PR:L), the default local storage adapter (instances using object-storage or CDN adapters on a separate origin are materially less exposed), and interaction by a victim staff user, typically one with higher privileges (UI:P). Vendor patch is available; no public exploit code has been identified at time of analysis.
Server-side request forgery in Loom for AWS before 1.7.0 lets an authenticated user with privileges to register, update, or test a tool server or remote agent (the MCP Server / A2A Agent integration feature) supply a crafted connection address that the backend fetcher follows and whose response body it echoes back, exposing the application container's own IAM role credentials and responses from arbitrary internal network locations. Exploitation requires a high-privileged authenticated account (CVSS PR:H) and is only meaningful where the container runs with a role worth stealing; there is no anonymous or pre-authentication path, and no public exploit identified at time of analysis. Deployments on or upgraded to 1.7.0, which adds IP-validated, DNS-pinned fetchers and connection-sink guards, are not affected.
Unauthenticated attackers can overwrite any existing wiki page in YesWiki versions before 4.6.7 by exploiting an authorization bypass in the Bazar entry-creation flow, where a crafted id_fiche matching an existing page is accepted without enforcing that page's write ACL. This enables mass defacement and content destruction, though exploitation requires the Bazar feature to be reachable without authentication and knowledge or guessing of valid page identifiers. A vendor patch is available in YesWiki 4.6.7, and no public exploit code has been identified at time of analysis.
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the server to fetch images from private or internal IP addresses, but only in applications that have configured images.remotePatterns. Affected releases are Next.js 16.0.0 through 16.3.7; the flaw is fixed in 16.3.8 by pinning the outbound connection to the DNS addresses that were already validated against the allow-list. Exploitation is not deterministic - the attacker must win a timing race between the allow-list check and the socket's own DNS lookup (DNS rebinding), consistent with the high attack-complexity rating - and no public exploit code has been identified at time of analysis (EPSS/KEV signals were not provided).
A use-after-free flaw in Chrome's Contextual Tasks component on Windows lets an attacker who has already compromised the renderer process break out of the browser sandbox and execute arbitrary code with the browser's privileges, triggered when the victim loads a crafted HTML page. Only Chrome builds on Windows prior to 154.0.8037.97 are affected, and exploitation is not an initial-access path: it requires a pre-existing renderer compromise plus user interaction, which is why the CVSS 3.1 base score of 8.3 reflects high attack complexity (AC:H). No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), with CISA SSVC rating exploitation as 'none' and automatable as 'no'; Google has shipped a vendor patch in version 154.0.8037.97, and Chrome's default auto-update resolves the exposure.
Consensus divergence in Zebra Zcash nodes before 4.4.0 allows unauthenticated remote attackers to craft V5 transparent transactions that Zebra accepts and includes in getblocktemplate, while zcashd rejects the resulting blocks. Exploitation requires a Zebra miner to select the malformed SIGHASH_SINGLE transaction and mine it into a block, so the impact is a block-validity split affecting integrity and availability rather than confidentiality; no public exploit code has been identified at time of analysis. Vendor-released patch: Zebra 4.4.0.
Server-side request forgery in YesWiki versions before 4.6.7 allows unauthenticated remote attackers to make the server issue blind GET and POST requests to internal hosts or cloud metadata endpoints by sending signed Follow activities to the public forms actor ActivityPub inbox. The attacker signs each request with their own keyId and places an internal actor URL in the ActivityPub body, so no victim credentials are required, but the attack succeeds only when the ActivityPub handling path processes the signed activity and a useful internal target is reachable. A vendor patch is available in 4.6.7; no public exploit was identified at time of analysis, and the independent assessment rates this as a moderate priority because reliability is constrained and confidentiality impact depends on cloud or segmented network exposure.
Server-side request forgery in YesWiki before 4.6.7 lets unauthenticated attackers reach internal services and cloud metadata endpoints by sending a crafted ActivityPub Signature keyId whose URL is expressed as an IPv6 transition address (6to4, NAT64, or IPv4-compatible IPv6), evading validateKeyIdUrl()'s SSRF guard. Exploitation requires the public federation actor-inbox route to be reachable by the attacker and involves non-trivial payload crafting, consistent with the independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N; no public exploit identified at time of analysis. Real-world impact depends heavily on what the YesWiki server can reach internally - cloud metadata (169.254.169.254), loopback services, or internal hosts make it serious, while instances without reachable internal targets yield little value.
Zcash Zebra nodes running zebrad 4.4.0 or zebra-script 6.0.0 incorrectly accept V5 transparent transactions in which a SIGHASH_SINGLE-signed input has no corresponding transparent output, allowing an unauthenticated remote attacker to broadcast crafted transactions that Zebra validates while zcashd rejects them and thereby create a consensus split. The flaw is a ZIP-244 signature-verification bypass (CWE-347) with a CVSS v4 base score of 8.3; no public exploit code was identified at time of analysis, and practical impact depends on a mixed Zebra/zcashd network, with most miners currently running zcashd. Vendor patches are available in zebrad 4.4.1 and zebra-script 6.0.1.
Observable padding discrepancy in the IES/ECIES decryption path of Bouncy Castle C# (bc-csharp) before 2.7.0 lets an unauthenticated remote attacker who has captured a valid ciphertext recover its plaintext through a CBC padding-oracle attack, because IesEngine.DecryptBlock strips padding and reports a distinguishable error before the MAC is checked. Exploitation requires non-default application behavior: IesEngine must be constructed directly with a padded block cipher such as AES-CBC with PKCS#7 padding, and the attacker must be able to repeatedly submit modified ciphertexts for decryption under the same static key pair and distinguish padding failures from MAC failures; stream-mode IES and standard ephemeral ECIES usage are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor CVSS 4.0 score of 8.2 is materially moderated by these prerequisites, which our independent assessment rates as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Denial of service in the PHP bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust process stack space and crash the parsing worker by supplying deeply nested or self-referential serialized Thrift messages. The flaw is an uncontrolled recursion (CWE-674) in the deserialization path, rated 8.2 High under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and 8.2-equivalent High under the assessed CVSS 3.1 vector (A:H only), confirming that impact is confined to availability. Exploitation is not unconditional: the CVSS 4.0 AT:P attack-requirement flag reflects that the target service must actually accept and deserialize attacker-controllable Thrift payloads through the PHP bindings, so internal services processing only trusted, bounded data are not realistically exposed. There is no public exploit code and no confirmed active exploitation at time of analysis, and a vendor-released fix is available in Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Perl bindings affects all releases before 0.25.0, allowing unauthenticated remote attackers to exhaust CPU or memory resources on services that deserialize attacker-controlled Thrift messages through the Perl language runtime. Only deployments using the Perl bindings are exposed; services built on the Java, Python, C++, or Go bindings are not affected by this specific flaw, and no public exploit code was identified at time of analysis, nor is there any CISA KEV confirmation of active exploitation. Impact is availability-only (no confidentiality or integrity loss), the vendor-released fix is Apache Thrift 0.25.0, and exploitation depends on the malicious input actually reaching the vulnerable parsing routine (the CVSS 4.0 AT:P / assessed AC:H condition).
Services that parse attacker-supplied input through Apache Thrift's Perl bindings before version 0.25.0 can be driven into an uncaught exception, crashing the hosting process or thread and causing a denial of service. The flaw is network-reachable and requires no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N, score 8.2), but its impact is confined to availability (VA:H) with no confidentiality or integrity effect, and the CVSS 4.0 AT:P metric indicates a specific precondition - the attacker's input must actually reach the vulnerable Perl deserialization/handler path. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is resolved by the vendor's 0.25.0 release.
Denial of service in Apache Thrift's JavaME bindings (versions before 0.25.0) allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol input, causing service outages. The flaw is CWE-770 (uncontrolled resource allocation) and is limited to availability impact; there is no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and upgrading to 0.25.0 resolves the issue.
Unbounded resource allocation in the Ruby bindings of Apache Thrift (versions before 0.25.0) lets unauthenticated remote clients exhaust server memory or CPU by sending Thrift messages whose declared structure or container sizes trigger excessive allocation while the service deserializes them. Only network-reachable services that actually accept and parse untrusted Thrift payloads through the Ruby bindings are exposed, and the impact is confined to availability, with no data disclosure or modification (C:N/I:N/A:H). The Apache Software Foundation has released 0.25.0 as the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor rates this 8.2 (High) under CVSS 4.0, while our independent assessment also treats it as High severity but notes a higher attack complexity (AC:H in v3.1 terms) because the attacker must reach a service that parses untrusted Thrift messages.
Denial of service in the Lua language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift messages that trigger uncontrolled allocation or inefficient algorithmic paths. The issue is limited to deployments that actively use the Lua bindings; other language bindings are unaffected. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and the impact is confined to availability-no data disclosure or code execution.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol messages that trigger inefficient algorithmic complexity (CWE-407). The vulnerability affects only applications that use the PHP bindings to deserialize untrusted Thrift input; other language bindings are unaffected. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 AT:P metric indicates a specific attack precondition must be met, so exploitation is not guaranteed against every deployment.
Denial of service in the Dart language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server memory and CPU by sending crafted Thrift messages to a network-reachable Dart-based service that deserializes untrusted input (CWE-770, allocation of resources without limits or throttling). Impact is limited to availability (service slowdown or crash); there is no confidentiality or integrity consequence, and deployments using other Thrift language bindings such as C++, Java, Python or Go are not affected. No public exploit code was identified at time of analysis and the vendor-released fix that resolves the issue is Apache Thrift 0.25.0.
Denial of service in Apache Thrift's Go bindings (versions before 0.25.0) lets unauthenticated remote attackers exhaust memory or CPU by sending highly compressed payloads over a compressed transport, so a tiny request expands into a disproportionately large in-memory buffer (CWE-409 data amplification / decompression bomb). Exploitation is conditional: per the vendor's CVSS 4.0 score the AT:P metric applies, meaning the affected service must actually accept attacker-supplied compressed data (for example a zlib-backed transport carrying untrusted input) - deployments of the Go bindings that do not parse compressed payloads from external sources are not exposed. Impact is availability-only (service crash, hang, or memory exhaustion) with no code execution or data disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment uses a 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflecting that precondition.
Denial of service in Apache Thrift's Python bindings before 0.25.0 arises from improper handling of highly compressed data (CWE-409), letting a remote, unauthenticated attacker send a small compressed Thrift payload that expands dramatically during parsing and exhausts server memory or CPU. Exploitation requires a service that accepts externally supplied Thrift data and decompresses or size-expands it, and the impact is confined to availability with no data disclosure or code execution. No public exploit code has been identified at time of analysis, and upgrading to 0.25.0 eliminates the vulnerability.
Denial of service in the D-language binding of Apache Thrift (thrift.server.nonblocking.TNonblockingServer) allows unauthenticated remote attackers to crash the server by sending a crafted or malformed message that provokes an uncaught exception and improper resource shutdown. Only deployments built with the D binding at versions before 0.25.0 and specifically using TNonblockingServer are affected, and the impact is limited to availability with no data exposure or modification. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 to fix the issue.
Integer underflow in Apache Thrift's C++ THeaderTransport can wrap a length or offset calculation and produce an out-of-bounds write, allowing a network attacker to crash or destabilize services that parse THeader-framed messages. The exposure is narrow: the library must be compiled as a 32-bit binary and must actually use THeaderTransport, while 64-bit builds and services relying on other transports are not affected, so the realistic outcome is denial of service rather than code execution or data disclosure. Affected releases are Apache Thrift before 0.25.0; no public exploit code has been identified at time of analysis, and the vendor's own scoring reflects availability-only impact (VA:H with no confidentiality or integrity effect).
Denial of service in Apache Thrift's Erlang bindings affects all releases before 0.25.0, where unauthenticated remote attackers who can reach a Thrift service that parses untrusted serialized input can send deeply nested or otherwise resource-heavy messages that the Erlang deserialization code processes without recursion-depth or allocation limits. The result is uncontrolled recursion and unbounded resource consumption (CWE-674), leading to service crash or hang - availability impact only, with no confidentiality or integrity loss confirmed. Exploitation requires the specific precondition that the target actually parses the attacker-supplied payload (CVSS 4.0 AT:P), and the flaw is confined to the Erlang bindings rather than all Thrift language bindings, so this is a moderate-priority availability issue rather than a top-tier emergency; no public exploit code has been identified at time of analysis, and the vendor-released fix is Apache Thrift 0.25.0.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Denial of service in the Erlang language bindings of Apache Thrift before 0.25.0 allows remote attackers to exhaust server resources through unbounded allocation, degrading or crashing the affected service. The flaw is CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v4.0 base score of 8.2; our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high-availability-only impact that requires a specific crafted message structure (AT:P) rather than arbitrary traffic. Only deployments running a Thrift server compiled with the Erlang bindings and exposed to attacker-reachable network traffic are affected; users of the C++, Java, Python, Go and other bindings are not impacted, and no public exploit code was identified at time of analysis.
Denial of service in the Apache Thrift PHP bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift service built on those bindings to exhaust server resources via unbounded allocation. The flaw is CWE-770 (allocation of resources without limits or throttling), triggered when the PHP binding processes attacker-controllable message sizes or collections without a cap; impact is limited to availability (VA:H; VC:N/VI:N), meaning no data disclosure or code execution. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so risk is highest for externally reachable Thrift endpoints that accept untrusted clients. Vendor-released patch: 0.25.0.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Uncontrolled recursion in Apache Thrift's c_glib (C/GLib) bindings causes stack exhaustion and process crash when a crafted, deeply nested message is deserialized from an untrusted source. Only applications built against the c_glib bindings at versions before 0.25.0 are affected; deployments using the Java, Python, C++ or other language bindings are not impacted by this specific issue. The flaw is availability-only - no confidentiality or integrity loss - and is reachable over the network without authentication (CVSS:4.0 PR:N, AT:P), though exploitation depends on the recursive parsing path being exposed to attacker-controlled input; no public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated, attacker-triggered exceptional conditions in the Apache Thrift Java bindings can leak server-side resources and degrade or exhaust a Thrift RPC service running any version before 0.25.0. The issue is remotely reachable without authentication (CVSS PR:N) and needs no user interaction, but the assessed impact is availability only - there is no confirmed confidentiality or integrity effect, so this is a denial-of-service exposure rather than a data-compromise issue. A CVSS 4.0 attack-requirement flag (AT:P) indicates a specific precondition must be met to drive the vulnerable error path, meaning not every request triggers the leak; the precise condition is not specified in the public advisory text, and no public exploit identified at time of analysis. Deployments not using the Java bindings, or already on 0.25.0 or later, are unaffected.