Apache Thrift c_glib: Uncontrolled recursion leads to denial of service
Summary
The c_glib bindings of Apache Thrift contain a flaw in their generated struct readers, which have no recursion-depth guard. A remote, unauthenticated attacker can send crafted data that causes uncontrolled recursion and exhausts the native stack, crashing the affected application or service. The CVSS v4.0 base score is 8.2 (High), with impact limited to availability; no exploitation or public proof of concept has been found.
Affected
- Apache Thrift c_glib bindings before 0.25.0
- Default configurations are not affected according to the CNA record.
Fixed in
- Apache Thrift 0.25.0
- openSUSE Tumbleweed: 0.25.0-1.1
- Bitnami: 0.25.0
- Other distribution package versions: Unknown.
Workaround
- No vendor workaround found.
- If an upgrade is not possible immediately, restrict network access to services that embed the c_glib bindings.
Exploitation
- Exploited in the wild: no evidence found.
- Public proof of concept: none found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- EPSS: 0.00426.
Our recommendation
- Identify software that uses Thrift c_glib bindings, including third-party and open-source products.
- Update Thrift to 0.25.0 or later, or install the fixed package from your vendor.
- Check your distribution's changelog to confirm the fix is included.
- Restrict network exposure of affected services until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache lists thread 33otcgbqd27wf6qq810q56znzbomnhg1 lists.apache.org
- Apache lists thread poskkt3p754b2f293g63934hw160o86j lists.apache.org
- CVE record mirror (Vulners) vulners.com
- OSV Ubuntu CVE-2026-94650 osv.dev
- OSV Bitnami thrift 0.25.0 advisory osv.dev
- SUSE CVE mirror (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:26.
Original description (NVD)
Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.