High
python-thrift, thrift — security advisory
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- Products
- python-thrift, thrift
- Affected versions
- 0.11.0-6, 0.13.0-2build1, 0.13.0-2build2, 0.13.0-6ubuntu1, 0.13.0-6ubuntu2, 0.13.0-6ubuntu3, 0.13.0-7, 0.16.0-2, 0.17.0-4, 0.19.0-2, 0.19.0-2.1build4, 0.19.0-2.1build5, 0.19.0-2build1, 0.19.0-4build1, 0.22.0-3, 0.22.0-3ubuntu1, 0.23.0-3, 0.23.0-3ubuntu1, 0.9.1-2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-94636
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:33 UTC · Revision 1
Source evidence
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
osv:UBUNTU-CVE-2026-94636
python-thrift
Fixed versions: Not specified
python-thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
thrift
Fixed versions: Not specified
Complete source record
{
"id": "bc64849be5d1646d94b6e1c4e2a42578efc2601567b606310ede85f080674e9e",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-94636",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-94636",
"summary": "Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.",
"evidence": "osv:UBUNTU-CVE-2026-94636",
"products": [
{
"name": {
"value": "python-thrift",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.1-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python-thrift",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.9.1-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.11.0-6",
"evidence": "/affected/2/versions"
},
{
"value": "0.13.0-2build1",
"evidence": "/affected/2/versions"
},
{
"value": "0.13.0-2build2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.13.0-6ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "0.13.0-6ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "0.13.0-6ubuntu3",
"evidence": "/affected/3/versions"
},
{
"value": "0.13.0-7",
"evidence": "/affected/3/versions"
},
{
"value": "0.16.0-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.17.0-4",
"evidence": "/affected/4/versions"
},
{
"value": "0.19.0-2",
"evidence": "/affected/4/versions"
},
{
"value": "0.19.0-2build1",
"evidence": "/affected/4/versions"
},
{
"value": "0.19.0-2.1build4",
"evidence": "/affected/4/versions"
},
{
"value": "0.19.0-2.1build5",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.22.0-3ubuntu1",
"evidence": "/affected/5/versions"
},
{
"value": "0.23.0-3",
"evidence": "/affected/5/versions"
},
{
"value": "0.23.0-3ubuntu1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "thrift",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.19.0-4build1",
"evidence": "/affected/6/versions"
},
{
"value": "0.22.0-3",
"evidence": "/affected/6/versions"
},
{
"value": "0.22.0-3ubuntu1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-94636",
"aliases": [
"UBUNTU-CVE-2026-94636"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-thrift",
"purl": "pkg:deb/ubuntu/python-thrift?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.9.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94636.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-thrift",
"binary_version": "0.9.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-thrift",
"purl": "pkg:deb/ubuntu/python-thrift?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.9.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94636.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-thrift",
"binary_version": "0.9.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.11.0-6",
"0.13.0-2build1",
"0.13.0-2build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94636.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "libthrift-0.13.0",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "libthrift-c-glib0",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "php-thrift",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.13.0-2build2"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.13.0-2build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.13.0-6ubuntu1",
"0.13.0-6ubuntu2",
"0.13.0-6ubuntu3",
"0.13.0-7",
"0.16.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94636.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.16.0-2"
},
{
"binary_name": "libthrift-0.16.0",
"binary_version": "0.16.0-2"
},
{
"binary_name": "libthrift-c-glib0",
"binary_version": "0.16.0-2"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.16.0-2"
},
{
"binary_name": "php-thrift",
"binary_version": "0.16.0-2"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.16.0-2"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.16.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.17.0-4",
"0.19.0-2",
"0.19.0-2build1",
"0.19.0-2.1build4",
"0.19.0-2.1build5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94636.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "libthrift-0.19.0t64",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "libthrift-c-glib0t64",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "php-thrift",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.19.0-2.1build5"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.19.0-2.1build5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.22.0-3ubuntu1",
"0.23.0-3",
"0.23.0-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94636.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "libthrift-0.23.0",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "libthrift-c-glib0t64",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "php-thrift",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.23.0-3ubuntu1"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.23.0-3ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "thrift",
"purl": "pkg:deb/ubuntu/thrift?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.19.0-4build1",
"0.22.0-3",
"0.22.0-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-94636.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-thrift-dev",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "libthrift-0.22.0",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "libthrift-c-glib0t64",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "libthrift-perl",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "php-thrift",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "python3-thrift",
"binary_version": "0.22.0-3ubuntu1"
},
{
"binary_name": "thrift-compiler",
"binary_version": "0.22.0-3ubuntu1"
}
]
}
}
],
"modified": "2026-10-17T13:01:18.841283170Z",
"provider": "osv",
"upstream": [
"CVE-2026-94636"
],
"references": [
"https://ubuntu.com/security/CVE-2026-94636",
"https://www.cve.org/CVERecord?id=CVE-2026-94636",
"https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs",
"https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
]
},
"related_cves": [
{
"value": "CVE-2026-94636",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 361628,
"published_at": "2026-10-02T12:17:00+00:00"
}