ECHO-8a2e-e261-ed24

See a problem?
Import Source
https://advisory.echohq.com/osv/ECHO-8a2e-e261-ed24.json
JSON Data
https://api.osv.dev/v1/vulns/ECHO-8a2e-e261-ed24
Upstream
  • CVE-2026-94656
Withdrawn
2026-10-05T18:43:47Z
Published
2026-10-03T09:20:14Z
Modified
2026-10-05T19:30:54Z
Summary
Ruby-only: TJsonProtocol has no string size bound. lib/rb is built but never packaged, for the reason given under CVE-2026-49158.
Details
References

Affected packages

Echo / thrift

Package

Name
thrift
Purl
pkg:deb/echo/thrift

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.19.0-4

Database specific

source
"https://advisory.echohq.com/osv/ECHO-8a2e-e261-ed24.json"