Package Health/org.apache.thrift:libthrift

libthrift

Thrift is a software framework for scalable cross-language services development.

Latest 0.24.0org.apache.thrift

Maven

91%

Total Score

healthy

Healthy: active Apache-backed project with strong maintenance, testing, and release transparency.

Are you affected? Scan for Free

Health Score Breakdown

License

The artifact and repository contain license files, and the registry declares Apache-2.0. The artifact also detects BSD-3-Clause text, which is a minor declaration mismatch but does not leave the release unlicensed.

Repo package mention

The repository name does not match the Maven package name and its README does not mention the package, creating a small identity-transparency concern. Apache ownership and the repository's Thrift-specific source tree partly compensate for that concern.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-916061 New libthrift is vulnerable to Resource Leak in versions 0.14.0 - 0.24.0.	0.14.0 - 0.24.0	High
AIKIDO-2026-851581 New libthrift is vulnerable to Denial of Service (DoS) in versions 0.14.0 - 0.24.0.	0.14.0 - 0.24.0	High
CVE-2026-43869 org.apache.thrift:libthrift is vulnerable to Improper Validation of Certificate with Host Mismatch in versions 0.0.0 - 0.22.0.	0.0.0 - 0.22.0	High
CVE-2019-0205 org.apache.thrift:libthrift is vulnerable to Loop with Unreachable Exit Condition ('Infinite Loop') in versions 0.0.0 - 0.12.0.	0.0.0 - 0.12.0	High
CVE-2020-13949 org.apache.thrift:libthrift is vulnerable to Uncontrolled Resource Consumption in versions 0.9.3 - 0.14.0.	0.9.3 - 0.14.0	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
org.slf4j:slf4j-api Version 1.7.36	—	—
org.apache.httpcomponents.client5:httpclient5 Version 5.2.1	—	—
org.apache.httpcomponents.core5:httpcore5 Version 5.2	—	—
jakarta.servlet:jakarta.servlet-api Version 5.0.0	—	—
jakarta.annotation:jakarta.annotation-api Version 2.1.1	—	—