CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2019-0210
High (7.5). EPSS 6.5% chance of exploitation in the next 30 days. Fixed in github.com/apache/thrift 0.13.0.
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
Severity
- EPSS
- 6.5% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:thrift
- oracle:communications_cloud_native_core_network_slice_selection_function
- redhat:jboss_enterprise_application_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jq7p-26h5-w78r | Go | github.com/apache/thrift | >=0.9.3 <0.13.0 | 0.13.0 |
| GO-2021-0101 | Go | github.com/apache/thrift | >=0.0.0-20151001171628-53dd39833a08 <0.13.0 | 0.13.0 |