Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Echo Thrift can skip message size validation
published 1 month ago
Summary
The Thrift library used by Echo may bypass a check on the size of incoming messages, which can let malformed data cause unexpected behavior. This can lead to crashes or allow an attacker to manipulate the service. Update to a version that includes the fix or rebuild the library with the Lua checks enabled.
What to do
- Update thrift to version 0.19.0-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | thrift | All versions |
| Echo | – | thrift |
< 0.19.0-4 Fix: upgrade to 0.19.0-4
|
Original advisory text
Lua-only: readMessageBegin skips checkStringSize on the pre-versioned
name. Built with --without-lua; no Lua binary package is produced.
References
Timeline
Published3 Oct 2026
Updated5 Oct 2026
First seen3 Oct 2026
Sources
ECHO-3073-2ab6-f3ce · OSV
Track software like this
Free during beta