Apache Thrift 9.4 RCE headlines a quiet five-patch day

Apache Thrift's Node.js web_server.js has multiple vulnerabilities that let a remote, unauthenticated attacker compromise the service. With a CVSS of 9.4, this is near the top of the scale. If you expose Thrift's Node.js server component to the network, treat this as urgent.

Affected estate

Anyone running Apache Thrift 0.15.0 on Azure Linux 3.0 or Ceph 16.2.10 on CBL Mariner 2.0 that bundles Thrift's Node.js server

How to check

Run `tdnf list installed thrift` or `tdnf list installed ceph` and compare to the affected versions.

Included because

unauthenticated; network-facing; critical CVSS 9.4; multiple platforms affected

Action

Run `tdnf update thrift` on azl3 and `tdnf update ceph` on cbl2. Restart any services that depend on Thrift's Node.js server.

Why it matters

A CVSS 9.4 unauthenticated remote attack vector against a network service is a fast path to compromise.

Source

Azure Linux advisory

A bug in curl causes it to incorrectly reuse an existing SMB connection for a different target. An attacker could exploit this to redirect SMB traffic or leak credentials to the wrong server. This matters most if your environment uses curl for SMB operations, which is uncommon but not unheard of in scripted workflows.

Affected estate

Azure Linux 3.0 operators running curl 8.11.1-6, particularly if any automation or tooling uses curl's SMB support

How to check

Run `curl --version` or `tdnf list installed curl` and confirm version 8.11.1-6.

Included because

network-facing; credential exposure risk; common utility

Action

Run `tdnf update curl` and verify the new version.

Why it matters

Credential leakage or misdirected SMB traffic if curl's SMB protocol support is in use.

Source

Azure Linux advisory

Go's `net` package panics when it encounters a NUL byte in Dial or LookupPort calls on Windows. An attacker who can feed crafted input to a Go application's network dialing code can crash the process. This primarily affects Go applications running on Windows, but the Azure Linux packages include Go toolchain and Go-built dependencies like TensorFlow/TensorBoard.

Affected estate

Azure Linux 3.0 operators running golang 1.25.9-1 or 1.26.2-1, gcc 13.2.0-7, python-tensorboard 2.16.2-6, or tensorflow 2.16.1-11

How to check

Run `go version` and `tdnf list installed golang gcc python-tensorboard tensorflow` to confirm affected versions.

Included because

denial of service; common runtime; multiple packages affected; attacker-controlled input path

Action

Run `tdnf update golang gcc python-tensorboard tensorflow`. Rebuild any locally compiled Go binaries with the updated toolchain.

Why it matters

A crash in any Go service that accepts external input for network dialing can cause denial of service.

Source

Azure Linux advisory

An integer underflow in FRRouting lets a remote attacker crash the BGP daemon by sending a crafted BGP UPDATE message. If your routers peer with untrusted or semi-trusted BGP neighbors, an attacker can take down your routing plane. This affects FRR stable/10.0 through stable/10.6.

Affected estate

Azure Linux 3.0 operators running FRRouting 10.5.0-3, especially on systems that accept BGP sessions from external peers

How to check

Run `vtysh -c 'show version'` or `tdnf list installed frr` to confirm version 10.5.0-3.

Included because

remotely exploitable; no authentication needed; network infrastructure; denial of service against routing plane

Action

Run `tdnf update frr`, then restart the FRR service with `systemctl restart frr`. Validate BGP sessions come back up cleanly.

Why it matters

A single crafted BGP UPDATE can crash your routing daemon, causing a network outage for everything behind it.

Source

Azure Linux advisory