Apache Thrift (PHP bindings): NULL pointer dereference in thrift_protocol accelerator
Summary
The PHP bindings of Apache Thrift, an RPC framework, contain a NULL pointer dereference in the thrift_protocol accelerator. A remote, unauthenticated attacker who can send crafted Thrift input to an affected PHP service can crash the process or worker, causing a denial of service. No data disclosure or code execution is reported. The risk is highest where a Thrift endpoint is reachable from the internet or accepts input from partners or customers.
Affected
- Apache Thrift versions before 0.25.0 with PHP bindings (Composer package apache/thrift)
- Linux distribution packages and bundled copies of Thrift in PHP applications, depending on the distribution version (for example Azure Linux thrift 0.24.0-1 is listed as affected)
Fixed in
- Apache Thrift 0.25.0 (upstream fix, per the CNA record and Apache advisory)
- Distribution-specific fixed package versions: unknown; check your distribution's security advisory (Red Hat Hardened Images ship thrift 0.25.0-0.1.hum1)
Workaround
Unknown. The CVE record lists no workaround; upgrading is the remedy.
- Until patched, limit which clients can reach Thrift endpoints and monitor PHP workers for crashes (own suggestion, not from the sources).
Exploitation
- CISA SSVC data: exploitation none, automatable yes, technical impact partial
- Not listed in CISA KEV
- No public proof of concept found at the time of research; this does not prove none exists
Our recommendation
- Inventory all PHP applications and dependencies that use Apache Thrift, including bundled copies and Linux packages.
- Update Composer projects to apache/thrift 0.25.0 and install the fixed package version from your distribution.
- Restrict access to Thrift endpoints, and prioritise any endpoint that is internet-facing or accepts partner input.
- Monitor PHP workers and logs for crashes and watch for a public proof of concept.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list advisory (thread 1) lists.apache.org
- Apache Thrift mailing list advisory (thread 2) lists.apache.org
- SentinelOne vulnerability database: CVE-2026-87117 www.sentinelone.com
- Vulners: CVE-2026-87117 vulners.com
- OpenCVE: CVE-2026-87117 app.opencve.io
- OSV: Azure Linux AZL-106608 osv.dev
- Red Hat RHSA-2026:74369 (via Vulners) vulners.com
- LinuxSecurity news: Apache Thrift 0.25.0 linuxsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:55.
Original description (NVD)
NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.