Apache Thrift: Denial of service via unbounded recursion in skip()
Summary
Several language bindings of Apache Thrift do not apply the recursion limit when skipping unknown fields. A specially crafted message with deeply nested unknown fields can exhaust the stack and crash the affected process. The issue affects the Python C++ accelerator, the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the pure-Python protocols are not affected. Exposure depends on whether such a Thrift service accepts input from untrusted networks.
Affected
- Apache Thrift before 0.25.0
- Python C++ accelerator
- PHP library and thrift_protocol extension
- Perl, Lua, Smalltalk and OCaml libraries
- Pure-Python protocols are not affected
Fixed in
- Apache Thrift 0.25.0
- Distribution packages: Unknown. Ubuntu and Azure Linux still show open status at the time of research.
Workaround
Unknown from sources. The vendor did not publish a workaround.
- Interim measure (not vendor-sourced): limit untrusted input reaching Thrift endpoints and apply a request size limit in front of them until the patch is installed.
Exploitation
- No public exploit code confirmed at the time of research (1 Nov 2026).
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS score: Unknown.
Our recommendation
- Identify Thrift-based services with an SBOM or package scan, including the apache/thrift Composer package and pypi thrift.
- Prioritise services reachable from the internet or untrusted networks.
- Upgrade to Apache Thrift 0.25.0 or a vendor-patched distribution package; build from source if no packages are available.
- Limit untrusted input and apply request size limits until patched.
- Monitor for service crashes or restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift CHANGES.md (0.25.0 section) apache.googlesource.com
- ASF security announcement (mail-archive copy) www.mail-archive.com
- Apache lists thread (CVE-2026-66858) lists.apache.org
- OSV: AZL-105950 (Azure Linux, last affected 0.24.0) osv.dev
- Ubuntu security notice CVE-2026-66858 ubuntu.com
- Vulners CVE-2026-66858 vulners.com
- TheHackerWire CVE-2026-66858 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:52.
Original description (NVD)
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.