{"id":"ECHO-5b20-0629-38e0","summary":"Erlang-only: thrift_json_protocol reads a whole message with no size\nbound. Built with --without-erlang; no Erlang binary package is\nproduced.\n","modified":"2026-10-05T19:30:54.518904072Z","published":"2026-10-03T09:20:14.201Z","withdrawn":"2026-10-05T18:43:47.546Z","upstream":["CVE-2026-96990"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-96990"},{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-96990"}],"affected":[{"package":{"name":"thrift","ecosystem":"Echo","purl":"pkg:deb/echo/thrift"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-4"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-5b20-0629-38e0.json"}}],"schema_version":"1.9.0"}