Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-83745

CVE-2026-83745: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh8.7

    High [CVE-2026-83745] Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings

    CVE-2026-83745Source published Source updated

    Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

    Affected products in this advisory
    • Apache Thrift
    Source-reported affected versions
    • Apache Thrift before 0.25.0
    Source-reported fixed versions
    • 0.25.0
    Mitigation guidance
    • Users are recommended to upgrade to version 0.25.0, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-83745] Denial of Service via excessive memory allocation in WebSocket transport

    CVE-2026-83745Source published Source updated

    Denial of Service via excessive memory allocation in WebSocket transport. Red Hat rates this important (CVSS 7.5). Weakness: CWE-130. Red Hat lists fixing advisory RHSA-2026:74369 with package thrift-main-0.25.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; and 1 more.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    • Red Hat Ceph Storage 7
    • Red Hat Ceph Storage 8
    • Red Hat Ceph Storage 9

    1 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • thrift-main-0.25.0-0.1.hum1
    • RHSA-2026:74369
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features