-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 25 Jul 2026 09:27:54 +0200
Source: thrift
Binary: golang-thrift-dev libthrift-0.24.0 libthrift-0.24.0-dbgsym libthrift-c-glib-dev libthrift-c-glib0t64 libthrift-c-glib0t64-dbgsym libthrift-dev libthrift-perl php-thrift php-thrift-dbgsym python3-thrift python3-thrift-dbgsym thrift-compiler thrift-compiler-dbgsym
Architecture: source all amd64
Version: 0.24.0-1
Distribution: experimental
Urgency: medium
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Description:
golang-thrift-dev - Go language support for Thrift
libthrift-0.24.0 - Thrift C++ library
libthrift-c-glib-dev - Thrift glib library (development headers)
libthrift-c-glib0t64 - Thrift glib library
libthrift-dev - Thrift C++ library (development headers)
libthrift-perl - Perl language support for Thrift
php-thrift - PHP language support for Thrift
python3-thrift - Python 3 library for Thrift
thrift-compiler - code generator/compiler for Thrift definitions
Changes:
thrift (0.24.0-1) experimental; urgency=medium
.
* New major upstream release:
- fixes CVE-2026-41608: unbounded zlib decompression in Python
THeaderTransport(),
- fixes CVE-2026-43871: TCompactProtocol() varint byte-count limit,
- fixes CVE-2026-45112: unbounded read leading to denial of service,
- fixes CVE-2026-48144: c_glib TLS client missing hostname verification,
- fixes CVE-2026-48145: C++ TSSLSocket matchName() RFC 6125 wildcard
bypass,
- fixes CVE-2026-48586: TZlibTransport decompression size limit,
- fixes CVE-2026-49158: Ruby THeaderTransport() zlib decompression bomb,
- fixes CVE-2026-55968: Node.js quadratic-time DoS in server receive
transports,
- fixes CVE-2026-55969: integer overflow in
TProtocol::checkReadBytesAvailable(),
- fixes CVE-2026-55970: C++ heap out of bounds read in
THeaderTransport::readHeaderFormat(),
- fixes CVE-2026-58023: c_glib heap out-of-bounds read in transport
leftover-bytes path,
- fixes CVE-2026-55971: C++ zlib heap buffer overflow (write) in
THeaderTransport::untransform(),
- fixes CVE-2026-58389: Rust binary protocol non-strict path missing
string size limit,
- fixes CVE-2026-58662: C++ THeaderTransport::readString() info-header
length bounds bypass,
- fixes CVE-2026-66053: Python TSSLSocket hostname matcher import.
* Update patches.
* Rename related packages to -0.24.0 suffix.
* Update copyright file.
Checksums-Sha1:
b5a241c5af16f0f1019dc93dd9dd8552afc3878e 3068 thrift_0.24.0-1.dsc
9fa62625ef663adafe4faea36e45acd6ffdbe727 4640299 thrift_0.24.0.orig.tar.gz
9b5288ab1f2fcbf848101c40a7d8cb6d298f8ed2 713 thrift_0.24.0.orig.tar.gz.asc
52a54326ac4a72b65e4b48bef80e571c0bbf121f 21900 thrift_0.24.0-1.debian.tar.xz
765ab6888af43db595d2ea60e40fb6a307379fe9 195392 golang-thrift-dev_0.24.0-1_all.deb
e16192477403bf83f589c6e0c74d96be80df20bc 3693068 libthrift-0.24.0-dbgsym_0.24.0-1_amd64.deb
dec2e1ea14b442ac90b7115db1ace9b5ee578ded 402624 libthrift-0.24.0_0.24.0-1_amd64.deb
53839b2f849154efb47efd872519807ca3970f6b 181852 libthrift-c-glib-dev_0.24.0-1_amd64.deb
2878c90db53e399bc76e47e4c7729b04b9b63794 148908 libthrift-c-glib0t64-dbgsym_0.24.0-1_amd64.deb
fc58341baeb5ba211390fb16505eeff0939aabaf 161880 libthrift-c-glib0t64_0.24.0-1_amd64.deb
a38e27b671fe573b226491fe856f67542d1e4f8b 561748 libthrift-dev_0.24.0-1_amd64.deb
c4b9cd027638707aaf0ac4c75a88a8fdcf307d02 131876 libthrift-perl_0.24.0-1_all.deb
43741df3cd256259e6b915ea169812026688694d 89456 php-thrift-dbgsym_0.24.0-1_amd64.deb
fa066677c05c36eb986f4e826309c87ec8812237 162212 php-thrift_0.24.0-1_amd64.deb
328d6ca20e0b71279ce0376079742cc00a89c1bd 316980 python3-thrift-dbgsym_0.24.0-1_amd64.deb
7b9a7f3436c64fbcb349b4be88c423c1737059a1 189520 python3-thrift_0.24.0-1_amd64.deb
6423a5198889cf09deef664f137e7568ed009eec 23843420 thrift-compiler-dbgsym_0.24.0-1_amd64.deb
78eb206033a39d5a1b521be0ee65cd798a329cf4 1555576 thrift-compiler_0.24.0-1_amd64.deb
00d823a747cd369d059a2b85a7f190a5abcda0e0 20877 thrift_0.24.0-1_amd64.buildinfo
Checksums-Sha256:
93d5b4637cd8f72be22d5024aa1a70a04e042ab2e7c352e4b9b959cf362ff66f 3068 thrift_0.24.0-1.dsc
e0fa5839a4c5c1d631b0931cf2c554ebbfa4e2fee3a9fb3ffd4f82ce4396c6e4 4640299 thrift_0.24.0.orig.tar.gz
0680a16fe3fc74da9f82c1d896c18d027b8b3a9e4a9b07e6400b6f79740e6fa5 713 thrift_0.24.0.orig.tar.gz.asc
ebc360f3144d764fb74e3ef3d4d540daff5fa9d084c1c70712d9e8343f7e5ad0 21900 thrift_0.24.0-1.debian.tar.xz
e2cdd65f58a07344fa27201e12c08c5cfdfadebb0faa542d099eddcf4f1e090c 195392 golang-thrift-dev_0.24.0-1_all.deb
3ad34fcdbe987eacadb35579912c5378d3f2df9d556014b864b3035d7719932d 3693068 libthrift-0.24.0-dbgsym_0.24.0-1_amd64.deb
7424c2e496fd43c908935634482b992fb8acbcb59ce53844e876e39d7cf27f9d 402624 libthrift-0.24.0_0.24.0-1_amd64.deb
05aeea1069dcb845c0b152728a993aeba975e17d2bfcd7004feaad34bafe7b13 181852 libthrift-c-glib-dev_0.24.0-1_amd64.deb
46c24b4dea1b59cc513fada90d3c1f9cf36dc2a78608839bef381bb666b1df1d 148908 libthrift-c-glib0t64-dbgsym_0.24.0-1_amd64.deb
2746650b5d28aa9b9c6342999e63bfe1043b8974816e1bbf50c096f8794f591d 161880 libthrift-c-glib0t64_0.24.0-1_amd64.deb
86406abb705cdb91eede3aec5f5b4860b1a8213d9888e929c1f539ff6386abe5 561748 libthrift-dev_0.24.0-1_amd64.deb
e15538d13e6d026b27e8f64838dc4db38a9c2634bb58d401add062137f65b0da 131876 libthrift-perl_0.24.0-1_all.deb
8fc210c1904efb8d79f95bba521b6977e4eeaa3e51f11c967af5dcc5433fa165 89456 php-thrift-dbgsym_0.24.0-1_amd64.deb
a7a2a58fbf75d784c1d3df1ad31f3f497620bdd2497c5cce437d21d2b944d2dd 162212 php-thrift_0.24.0-1_amd64.deb
75efcb1677266cb95a5eec58b49c836847ffde6175d32feb5bafbe425be539db 316980 python3-thrift-dbgsym_0.24.0-1_amd64.deb
3b35bafc9413e33a4523b015440371406d2cbfaf6d98e825c52b8435623185c9 189520 python3-thrift_0.24.0-1_amd64.deb
55a16bfa6d30695bc0c78a3dffd3343701509eaee30c194b33547eb8de3ae7be 23843420 thrift-compiler-dbgsym_0.24.0-1_amd64.deb
b01643e390312d7d4e3aad8e2e10f97d1863f0431b3f59ff202bc73061ed0be0 1555576 thrift-compiler_0.24.0-1_amd64.deb
dc713fb80211ca12835ac2df482e843abaed552d3398a2d3bc0e85d61adfd1ee 20877 thrift_0.24.0-1_amd64.buildinfo
Files:
67e703a2e9fa4899cd08c2b7b87d7c9e 3068 devel optional thrift_0.24.0-1.dsc
232e035ff80c5fb4b7243f0be3a76b02 4640299 devel optional thrift_0.24.0.orig.tar.gz
28292f293b6d0e4b8735cc461667a7f2 713 devel optional thrift_0.24.0.orig.tar.gz.asc
311a91c290f696a420bec5c5091923b7 21900 devel optional thrift_0.24.0-1.debian.tar.xz
ce2845a8cba07f6cd71d727c6a6bafd2 195392 devel optional golang-thrift-dev_0.24.0-1_all.deb
49f9545ddc00749d2b74344417f69ef0 3693068 debug optional libthrift-0.24.0-dbgsym_0.24.0-1_amd64.deb
a9155454f7d209c3a76ea2f1ecce691f 402624 libs optional libthrift-0.24.0_0.24.0-1_amd64.deb
b475ca1b050e494b1cf8ec18d9d43e45 181852 libdevel optional libthrift-c-glib-dev_0.24.0-1_amd64.deb
c3da8de9e211c1c9f6b76f81d9352845 148908 debug optional libthrift-c-glib0t64-dbgsym_0.24.0-1_amd64.deb
26f604bfe92b206b05d6f8722834ebcf 161880 libs optional libthrift-c-glib0t64_0.24.0-1_amd64.deb
2cf6fd8c9d97ecf183a301d87786298d 561748 libdevel optional libthrift-dev_0.24.0-1_amd64.deb
5a6bd2444dfc91d84b27a62384231e8d 131876 perl optional libthrift-perl_0.24.0-1_all.deb
f3b8905bc73d4bd301ed9b2859d718e4 89456 debug optional php-thrift-dbgsym_0.24.0-1_amd64.deb
4d4d912d8a2c1cedfa7320fcfa9395f0 162212 php optional php-thrift_0.24.0-1_amd64.deb
f9a24b467963ffddd8f1c18421f2e35b 316980 debug optional python3-thrift-dbgsym_0.24.0-1_amd64.deb
23f6e876a4bef25faf894fe3c3600c2c 189520 python optional python3-thrift_0.24.0-1_amd64.deb
2fc3a98e96fa9452fbb357343c3fb488 23843420 debug optional thrift-compiler-dbgsym_0.24.0-1_amd64.deb
6006d2fcdce8c77ed1ec2dca0814b590 1555576 devel optional thrift-compiler_0.24.0-1_amd64.deb
8236ace01fca7b13af38734e635a3784 20877 devel optional thrift_0.24.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmpluYEACgkQ3OMQ54ZM
yL8RTRAAjJHOiGbjPqwFJ6uE0xIHcZPmSwC2FbLNWMzThU3KNxmsTu0/yFq5G859
tz86XKjb+iRbJnZmqyPWaJrY1ykB+OOUsZiHRBEHVHf0s1VQ9fu+i3MHU+l9igGj
bNHiAhVwJLTdouXKJTpKsyYCD48F7ahlTAv+VCbGd/KI6wrLdTn4KLQN9rOze8qP
gp5K174z/uJl5gkCF30bCqvSLwN0tm3uas1WtPnU0LXbh9Ltg20jJJxPckG2vWjM
Xi1osmJe4ZLNaeyyuYNRugpexLqVy8sqoYODDlxKpq6YSul1t01Yyx6lsCp8pRml
1RQsCrM95fnjIfOZYPMKrD/Bqw08Q7HH5ViqpKQZJpywfoNdwFIiH/h+2kzP7phX
RrwGaXQQowMg7YxoOtLA8Gb/G4IzQJPTHzfklZlNJ4WB+wYPMa9ngLhhIQ4AVbZn
b07uQdO1zBIkjG16LUz1sIrnX5lpfH4/i0Avqg4zAby28surHFmR3VgNDzKWsYce
AH0x/5+OqI2Hbm1EmMhL8Pq31drvd04a7OnHQN5JWzFYt4Kg+wiiK1dqsWG5GUY0
G/wDJ2KXzG2wPQl4eXhCkrCe3P+xT6BAoHLtIG2+M96EDX0MpIa3KOVyyQnj7FxY
2nE/S0GeAwtms+yXXNH35Yv4TwwRKaf/zpFyeh5kf0a6lzol6/E=
=uc9g
-----END PGP SIGNATURE-----
