packagist package reportIs apache/thrift safe?
1 known vulnerability, worst severity HIGH.
// reach0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
// ai model usageTracked for PyPI packages. HuggingFace models declare Python dependencies, so packagist packages are not covered.
epsschance of exploitation in 30 days, 62nd percentile of all CVEs
xyz scoreCyberXYZ composite out of 10
fig. 01 — GHSA-8wv5-x4w7-5gww, the advisory selected below
// 1 advisories
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Checked 2026-09-26 at 01:00 UTC. The most recent advisory here was published 2026-07-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.