High
thrift — security advisory
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- Products
- thrift
- Affected versions
- 0.11.0-6, 0.13.0-2build1, 0.13.0-2build2, 0.13.0-6ubuntu1, 0.13.0-6ubuntu2, 0.13.0-6ubuntu3, 0.13.0-7, 0.16.0-2, 0.17.0-4, 0.19.0-2, 0.19.0-2.1build4, 0.19.0-2.1build5, 0.19.0-2build1, 0.19.0-4build1, 0.22.0-3, 0.22.0-3ubuntu1, 0.23.0-3, 0.23.0-3ubuntu1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-94646
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:33 UTC · Revision 1
Source evidence
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
osv:UBUNTU-CVE-2026-94646
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
Complete source record
{
"id": "cb28154fc7943f17a31f860191749dfaf9fcc75c334e1d3595afa3bf6517d65b",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-94646",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-94646",
"summary": "Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.",
"evidence": "osv:UBUNTU-CVE-2026-94646",
"products": [
{
"name": {
"value": "thrift",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.11.0-6",
"evidence": "/affected/0/versions"
},
{
"value": "0.13.0-2build1",
"evidence": "/affected/0/versions"
},
{
"value": "0.13.0-2build2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.13.0-6ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "0.13.0-6ubuntu2",
"evidence": "/affected/1/versions"
},
{
"value": "0.13.0-6ubuntu3",
"evidence": "/affected/1/versions"
},
{
"value": "0.13.0-7",
"evidence": "/affected/1/versions"
},
{
"value": "0.16.0-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.17.0-4",
"evidence": "/affected/2/versions"
},
{
"value": "0.19.0-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.19.0-2build1",
"evidence": "/affected/2/versions"
},
{
"value": "0.19.0-2.1build4",
"evidence": "/affected/2/versions"
},
{
"value": "0.19.0-2.1build5",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.22.0-3ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "0.23.0-3",
"evidence": "/affected/3/versions"
},
{
"value": "0.23.0-3ubuntu1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.19.0-4build1",
"evidence": "/affected/4/versions"
},
{
"value": "0.22.0-3",
"evidence": "/affected/4/versions"
},
{
"value": "0.22.0-3ubuntu1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-94646",
"aliases": [
"UBUNTU-CVE-2026-94646"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.11.0-6",
"0.13.0-2build1",
"0.13.0-2build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94646.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "libthrift-0.13.0",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "libthrift-c-glib0",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "php-thrift",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.13.0-2build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.13.0-6ubuntu1",
"0.13.0-6ubuntu2",
"0.13.0-6ubuntu3",
"0.13.0-7",
"0.16.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94646.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.16.0-2"
},
{
"binary_name": "libthrift-0.16.0",
"binary_version": "0.16.0-2"
},
{
"binary_name": "libthrift-c-glib0",
"binary_version": "0.16.0-2"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.16.0-2"
},
{
"binary_name": "php-thrift",
"binary_version": "0.16.0-2"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.16.0-2"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.16.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.17.0-4",
"0.19.0-2",
"0.19.0-2build1",
"0.19.0-2.1build4",
"0.19.0-2.1build5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94646.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "libthrift-0.19.0t64",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "libthrift-c-glib0t64",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "php-thrift",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.19.0-2.1build5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.22.0-3ubuntu1",
"0.23.0-3",
"0.23.0-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94646.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "libthrift-0.23.0",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "libthrift-c-glib0t64",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "php-thrift",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.23.0-3ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.19.0-4build1",
"0.22.0-3",
"0.22.0-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94646.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "libthrift-0.22.0",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "libthrift-c-glib0t64",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "php-thrift",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.22.0-3ubuntu1"
}
]
}
}
],
"modified": "2026-10-17T13:01:18.942889631Z",
"provider": "osv",
"upstream": [
"CVE-2026-94646"
],
"references": [
"https://ubuntu.com/security/CVE-2026-94646",
"https://www.cve.org/CVERecord?id=CVE-2026-94646",
"https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8",
"https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
]
},
"related_cves": [
{
"value": "CVE-2026-94646",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 361642,
"published_at": "2026-10-02T12:17:00+00:00"
}