{"action":"Upgrade github.com/apache/thrift to 0.10.0 or later.","affected":[{"fixed":"0.10.0","introduced":"0"}],"component":"github.com/apache/thrift","cve_ids":["CVE-2016-5397"],"ecosystem":"Go","epss":0.06873,"exploited":false,"fixed_versions":["0.10.0"],"ghsa_id":"GHSA-r4m4-pmvw-m6j5","id":"tcs_01M5KFM23DNVPC3VF6H5AHPF0D","modified_at":"2026-09-10T03:49:36.542550638Z","published_at":"2022-05-13T01:25:56Z","references":["https://osv.dev/vulnerability/GHSA-r4m4-pmvw-m6j5","https://nvd.nist.gov/vuln/detail/CVE-2016-5397","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2019:3140","https://issues.apache.org/jira/browse/THRIFT-3893","https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E","https://web.archive.org/web/20210124141102/http://www.securityfocus.com/bid/103025","http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-r4m4-pmvw-m6j5","url":"https://osv.dev/vulnerability/GHSA-r4m4-pmvw-m6j5"}],"summary":"Apache Thrift Go Library Command Injection"}