Apache Thrift JavaME bindings: Uncontrolled resource consumption via JSON strings

Summary

The JavaME bindings of Apache Thrift do not limit the size of strings processed by the TJSONProtocol. A remote attacker who can send messages to a Thrift service using these bindings may exhaust resources and cause a denial of service. The issue is rated as high in CVSS v4.0 but affects availability only, and the vulnerable use depends on conditions in the deployment.

Affected

• Apache Thrift before 0.25.0 (JavaME bindings, TJSONProtocol)
• Exact JavaME-specific version list: Unknown.

Fixed in

• Apache Thrift 0.25.0
• Release date reported as September 30, 2026 by a secondary source; verify on the Apache download page.

Workaround

Unknown. No vendor workaround found.

Exploitation

• No public proof of concept known.
• Not listed in CISA KEV; CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No known exploitation in the wild.

Our recommendation

• Check whether Thrift is used, especially the JavaME bindings; confirm with developers or the software inventory.
• Upgrade libthrift to Apache Thrift 0.25.0 or later where present.
• If an internet-facing Thrift service uses these bindings, prioritise the upgrade and limit exposure.
• Monitor the Apache mailing-list advisory and NVD for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache mailing list thread (vendor advisory) lists.apache.org
• OSV: BIT-thrift-2026-94657 osv.dev
• Rapid7 via Vulners vulners.com
• PSIRT.com CVE details psirt.com
• Linux Security: Apache Thrift 0.25.0 release linuxsecurity.com
• Red Hat details via OpenCVE app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:13.