Apache Thrift Go: Unbounded resource allocation allows unauthenticated crash
Summary
The Go bindings of Apache Thrift before 0.25.0 allocate resources without limits when processing the THeader transform count. An unauthenticated remote attacker can crash a Go Thrift server with a single crafted packet, causing a denial of service. Confidentiality and integrity are not affected according to the CVSS vector. The flaw matters where a Go Thrift server is reachable over the network, including indirectly through third-party software that embeds Go Thrift.
Affected
- Apache Thrift before 0.25.0 (Go bindings, Go module github.com/apache/thrift)
- Third-party software that embeds the affected Go Thrift code
Fixed in
- Upgrade to Apache Thrift 0.25.0 or later, which fixes the issue.
Workaround
Unknown. Restricting network access to Thrift Go services reduces exposure but does not fix the flaw.
Exploitation
- No known exploitation in the wild found in the sources reviewed.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS score 0.00426 (low; date not shown).
- Not verified in the CISA KEV catalog.
Our recommendation
- Inventory Go applications and container images for github.com/apache/thrift (check go.sum).
- Check vendor advisories for embedded Thrift components.
- Upgrade to Apache Thrift 0.25.0 or later. Note that 0.25.0 also fixes many other vulnerabilities.
- Do not expose Thrift Go services to the internet; restrict access to trusted networks.
- Monitor Go services for crashes and unexpected restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list advisory (mirror) www.mail-archive.com
- OSV: BIT-thrift-2026-63772 osv.dev
- Apache lists thread 33otcgbqd27wf6qq810q56znzbomnhg1 lists.apache.org
- Apache lists thread 6kpzdw29gsfxptv4b65y9s6f42tdyo8k lists.apache.org
- Go package github.com/apache/thrift pkg.go.dev
- LinuxSecurity: Apache Thrift 0.25.0 message and memory limits linuxsecurity.com
- OpenCVE: CVE-2026-63772 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:53.
Original description (NVD)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.