{"id":"ECHO-5b20-0629-38e0","upstream":["CVE-2026-96990"],"severity":[],"modified":"2026-10-05T18:43:47.546Z","affected":[{"package":{"ecosystem":"Echo","name":"thrift"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-4"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-96990"},{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-96990"}],"withdrawn":"2026-10-05T18:43:47.546Z","summary":"Erlang-only: thrift_json_protocol reads a whole message with no size\nbound. Built with --without-erlang; no Erlang binary package is\nproduced.\n"}