Apache Thrift: Allocation of resources without limits in TJSONProtocol
Summary
Apache Thrift libraries for C++, Java, Go, .NET, Python and Delphi accept a single JSON string or number that exceeds the configured size limit. An attacker who can send crafted input to a Thrift-based service can cause excessive memory allocation and denial of service. The CVE record describes the issue as CWE-770 with a CVSS 4.0 score of 8.2 as provided; this score could not be verified in NVD.
Affected
- Apache Thrift before 0.25.0 (all language bindings listed in the CVE record)
- Downstream applications that embed a vulnerable Thrift library, for example through Maven, NuGet or PyPI
- Azure Linux thrift package up to 0.24.0-1 (per OSV)
Fixed in
- Apache Thrift 0.25.0 (released 2026-09-30 per the Apache download page)
- Exact fixed versions per language binding beyond the 0.25.0 release: Unknown.
Workaround
- No vendor-published workaround found.
- If an upgrade is not possible, limit input size in the application that uses Thrift. This is a suggestion, not a vendor recommendation.
Exploitation
- No evidence of in-the-wild exploitation found; no CISA KEV entry.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept found.
Our recommendation
- Inventory Thrift libraries, including transitive Maven, NuGet and PyPI dependencies.
- Prioritise internet-facing or partner-facing services that use Thrift.
- Upgrade to Apache Thrift 0.25.0 or later where the vendor package supports it.
- Verify the CVE record in NVD before relying on the severity score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache lists thread (CVE-2026-66055) lists.apache.org
- Apache lists thread (second reference) lists.apache.org
- OSV: BIT-thrift-2026-66055 osv.dev
- Apache Thrift download page thrift.apache.org
- Apache Thrift CHANGES.md apache.googlesource.com
- Vulners: CVE-2026-66055 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:14.
Original description (NVD)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.