The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Thrift.

Apache Thrift: C++ THttpTransport grows its line buffer without bound

Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec

Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript

Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end