Detections
Analytics

Echo: thrift: security update to 0.19.0-4

high Tenable Self-Hosted Container Security Plugin ID 472916

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Memory allocation with excessive size value, Improper handling of length parameter inconsistency
 vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read
 the payload length out of the frame header and allocate that many bytes immediately, without checking that
 the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare --
 measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js
 case the connection is left open afterwards, so the frame can simply be sent again. This issue affects
 Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
 (CVE-2026-83745)

Solution

Update the thrift library and its related packages to version 0.19.0-4 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-83745

Plugin Details

Severity: High

ID: 472916

Version: Revision 1.1

Type: Local

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.17

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-83745

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/3/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-83745