Apache Thrift: Denial of service via unbounded length handling in bindings
Summary
Several language bindings of Apache Thrift (including Python, Ruby, PHP and Perl) read buffer sizes declared by a peer without any limit. A remote, unauthenticated attacker who can send crafted messages to a Thrift-based service can exhaust resources and cause a denial of service. Confidentiality and integrity are not affected, and the attack requires a Thrift service that is reachable from the attacker's network.
Affected
- Apache Thrift before 0.25.0, for the affected language bindings: Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D.
- Distribution packages: check your distribution's advisory for the exact fixed package version.
Fixed in
- Apache Thrift 0.25.0 (released September 30, 2026, per third-party reporting).
Workaround
- No vendor-documented workaround known. Upgrading is the stated remedy.
- Keep Thrift services off untrusted networks and limit message sizes at a reverse proxy or firewall until patched (general mitigation, not vendor guidance).
Exploitation
- No public proof-of-concept known.
- Not known to be exploited in the wild. Not verified against the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify software in your environment that embeds Apache Thrift, especially components with a public interface.
- Patch affected components to Apache Thrift 0.25.0 or the vendor's fixed package version, prioritising internet-facing services.
- Restrict access to Thrift ports to trusted networks and monitor for resource exhaustion or crashes of these services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list thread (vendor, first reference in CVE record) lists.apache.org
- Apache Thrift mailing list thread (second reference in CVE record) lists.apache.org
- Apache Thrift 0.25.0 release news (LinuxSecurity) linuxsecurity.com
- NVD summary (Vulners) vulners.com
- CVE list record (Vulners) vulners.com
- CBL-Mariner advisory (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:07.
Original description (NVD)
Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.