Apache Thrift c_glib: Infinite loop in read_all leads to denial of service
Summary
The c_glib bindings of Apache Thrift contain an infinite loop in the read_all function, which spins when the underlying read returns 0. An attacker who can send data to a c_glib-based Thrift service or client can cause it to hang and consume CPU, resulting in denial of service. The vector is network-reachable without privileges or user interaction, but attack requirements exist, and exposure depends on whether untrusted peers can reach the service.
Affected
- Apache Thrift c_glib bindings before 0.25.0
- Versions 0 to less than 0.25.0 are affected according to the CVE record
Fixed in
- Upgrade to Apache Thrift 0.25.0
- Distribution packages: Azure Linux 0.25.0-1; Red Hat Hardened Images thrift-glib 0.25.0-0.1.hum1 (other distributions: check their trackers, fixed versions not confirmed)
Workaround
Unknown. No workaround is documented in the sources; restricting which hosts can reach Thrift services is a compensating control until patching.
Exploitation
- No evidence of exploitation in the wild found; no CISA KEV listing found
- No public proof of concept found
- CISA SSVC: exploitation none, automatable no, technical impact partial
Our recommendation
- Identify whether any c_glib-based Thrift service or client is installed, and ask software suppliers whether they embed it
- Restrict network access to Thrift services from untrusted sources until patched
- Upgrade to Apache Thrift 0.25.0 or the distribution's fixed package in the next maintenance window; one upgrade also covers related Thrift CVEs with the same fix line
- Priority: medium for internet-facing services, low for internal-only use
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache lists thread 1 lists.apache.org
- Apache lists thread 2 lists.apache.org
- OSV UBUNTU-CVE-2026-85476 osv.dev
- OSV DEBIAN-CVE-2026-85494 osv.dev
- Red Hat RHSA-2026:74369 CVE-2026-85476 vulners.com
- Azure Linux CBLMARINER:106545 vulners.com
- NVD/OpenCVE record CVE-2026-85476 app.opencve.io
- CVE record CVE-2026-85476 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:14.
Original description (NVD)
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.