Apache Thrift c_glib: Access of uninitialized pointer in read_message_begin
Summary
The c_glib (GLib-based C) language bindings of Apache Thrift contain a memory-safety bug in read_message_begin, where output parameters are left unset for non-versioned messages. The CVSS vector rates the flaw as network-reachable and requiring no authentication, with an impact limited to availability, so an attacker could most likely crash or hang a vulnerable service. Only C or GLib applications built on Thrift are affected; the sources do not describe the exact trigger conditions.
Affected
- Apache Thrift before 0.25.0 (c_glib bindings)
- Debian tracker lists affected package versions up to 0.24.0-2
- Related: CVE-2026-66859 is fixed by the same release
Fixed in
- Apache Thrift 0.25.0
- Azure Linux/CBL-Mariner tracks a fix in 0.25.0-1
- Fixed package versions for Ubuntu, Red Hat and Debian: Unknown.
Workaround
- Unknown. No vendor workaround was found.
- If an upgrade is not possible, restrict network access to c_glib-based Thrift services and monitor them for crashes.
Exploitation
- CISA KEV: not listed.
- Public proof of concept: none found (psirt.com: Has Public Exploit: No).
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Run an inventory for libthrift or thrift packages and c_glib builds.
- If a c_glib-based service accepts network input, upgrade to Apache Thrift 0.25.0 or the fixed distribution package.
- Until patched, restrict access to the service.
- Priority for most SMEs: medium. Java, Python or Go Thrift deployments are not affected by this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache dev-list announcement (Pony Mail) lists.apache.org
- Apache dev-list thread (Pony Mail) lists.apache.org
- Apache dev-list mirror (mail-archive) www.mail-archive.com
- Vulners CVE record vulners.com
- OSV Debian record osv.dev
- Debian package libthrift-c-glib0 packages.debian.org
- OSV AZL-106590 (CVE-2026-66859) osv.dev
- Vulners CBL-Mariner CBLMARINER:106557 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:51.
Original description (NVD)
Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.