Apache Thrift: Missing default string length limit in Python TJSONProtocol
Summary
Apache Thrift before 0.25.0 has a Python TJSONProtocol implementation whose string length limit is disabled by default. A remote attacker who can send crafted Thrift JSON messages to a Python service that parses them can exhaust resources and cause a denial of service. The CVSS 4.0 vector indicates no privileges and no user interaction are required, with high availability impact.
Affected
- Apache Thrift, Python bindings: all versions before 0.25.0
- Default configuration: unaffected only if a string length limit is set explicitly (per vendor record, default is unaffected for the limit; the issue concerns the limit being off by default)
- Transitive dependencies: check lock files, as some connectors cap Thrift below 0.25.0
Fixed in
- Apache Thrift 0.25.0 (released 30 September 2026)
Workaround
- No vendor workaround found.
- Interim measure (not from a vendor source): limit request sizes at the reverse proxy or application layer and restrict which hosts can reach the Thrift service.
Exploitation
- CISA SSVC assessment: Exploitation none, not automatable, partial technical impact.
- No public proof of concept found.
- No evidence of active exploitation found. CISA KEV catalogue not checked directly.
Our recommendation
- Identify Python services that use Thrift, including transitive dependencies, and check whether they parse Thrift JSON from untrusted network clients.
- Upgrade Apache Thrift to 0.25.0 or later.
- Review the 0.25.0 change to the TBinaryProtocol default string length limit (about 16 MB) and set explicit overrides where large payloads are handled.
- Verify the Apache advisory directly before closing the ticket.
- Priority: medium to high if a service accepts network input; low if Thrift is used only internally behind authentication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache list thread (CVE reference 1) lists.apache.org
- Apache list thread (CVE reference 2) lists.apache.org
- OSV record BIT-thrift-2026-94634 osv.dev
- Nixpkgs issue 569838 github.com
- Linux Security: Apache Thrift 0.25.0 message memory limits linuxsecurity.com
- Databricks SQL Python PR 975 github.com
- Databricks SQL Python issue 969 github.com
- Snyk package record: pip thrift security.snyk.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:27.
Original description (NVD)
Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.