Apache Thrift: Uncontrolled recursion in Dart and Java ME bindings
Summary
The Dart and Java ME bindings of Apache Thrift, a cross-language RPC and serialisation framework, do not limit the nesting depth when decoding peer-supplied data. A remote, unauthenticated attacker can send specially crafted requests that trigger excessive recursion, exhausting system resources and crashing the affected service (denial of service). The issue only matters if a service built on these bindings accepts network input from untrusted parties.
Affected
- Apache Thrift before 0.25.0, Dart and Java ME bindings
- Other language bindings are not named in the CVE record
- Debian 12 (thrift) is listed as affected in OSV
Fixed in
- Apache Thrift 0.25.0 (released Sep 30, 2026, according to a secondary source; verify on the Apache release page)
- Unknown: exact fixed package versions for Debian and Ubuntu
Workaround
- Unknown: the CVE record provides no workaround.
- If an upgrade is delayed, restrict which hosts can reach the affected services.
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- Not listed in the CISA KEV catalogue.
- No proof of concept found; status treated as unknown.
Our recommendation
- Search code, containers and package lists for Apache Thrift and identify which language bindings are in use.
- Where Dart or Java ME bindings run on network-facing services, plan the upgrade to 0.25.0 or the distribution package.
- Restrict network access to affected services until patched.
- Monitor the Apache mailing-list threads and the NVD record for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread 1 lists.apache.org
- Apache mailing list thread 2 lists.apache.org
- Apache Thrift changelog thrift.apache.org
- OSV: Debian CVE record osv.dev
- OpenCVE CVE record app.opencve.io
- Vulners CVE record vulners.com
- Red Hat advisory RHSA-2026:74369 vulners.com
- Linux Security news on Apache Thrift 0.25.0 linuxsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:07.
Original description (NVD)
Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.