Apache Thrift Java bindings: Uncontrolled recursion in TProtocolUtil.skip()
Summary
The Java bindings of Apache Thrift (libthrift) do not limit recursion depth in TProtocolUtil.skip() by default. An attacker who can send crafted data to a Thrift-based Java service can exhaust memory or the stack, causing a denial of service. Exploitation requires that the service accepts network input; the CVSS 4.0 score of 8.2 reflects availability impact only.
Affected
- Apache Thrift Java bindings (Maven artifact org.apache.thrift:libthrift) before 0.24.0
- Earlier affected version boundary: Unknown.
- Transitive dependencies on libthrift in Java applications are also affected.
Fixed in
- Upgrade to Apache Thrift 0.24.0 or later.
- Erlang bindings: a separate issue (CVE-2026-96288) is fixed in 0.25.0.
Workaround
- Unknown. No vendor-documented workaround was found; upgrading is the recommended fix.
Exploitation
- No confirmed exploitation in the wild.
- Not listed in CISA KEV.
- No public proof of concept confirmed.
Our recommendation
- Inventory all libthrift (Maven) dependencies, including transitive ones, and Thrift-based services.
- Upgrade Java libthrift to 0.24.0 and Erlang bindings to 0.25.0.
- Prioritise services reachable from the internet or untrusted networks.
- Re-check the Apache advisory and NVD once they are updated.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift download page thrift.apache.org
- Apache Thrift changelog thrift.apache.org
- Apache mailing list thread 1 lists.apache.org
- Apache mailing list thread 2 lists.apache.org
- oss-security post www.openwall.com
- VulDB CVE-2026-120135 vuldb.com
- OffSeq radar entry radar.offseq.com
- OSV CVE-2026-96288 (Erlang bindings) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:26.
Original description (NVD)
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.