GitHub Advisoryadvisory · crates.io

GHSA-2f9f-gq7v-9h6m Apache Thrift has a Memory Allocation with Excessive Size Value Vulnerability

MEDIUM Published 2026-05-05 Modified 2026-07-21 Official page ↗
Aliases
CVE-2026-43868
Ecosystem
crates.io
Packages
thrift
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1285, CWE-789
Reviewed
2026-05-08

Affected packages

• crates.io thrift: < 0.23.0 → fixed in 0.23.0

Description

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-43868 Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. vulnerability

Weakness · CWE (2)

  • CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input weakness
  • CWE-789 Memory Allocation with Excessive Size Value weakness

References