Apache Thrift Perl bindings: Inefficient algorithmic complexity (quadratic)
Summary
Apache Thrift's Perl bindings re-slice the remaining buffer on every call in the FramedTransport read path and the TLS socket write path, so processing time grows quadratically with the data size. A network-reachable attacker without authentication can send crafted traffic to a Perl service that speaks Thrift and exhaust CPU resources, which leads to a denial of service. Only Perl applications that use the Thrift CPAN module are affected, and the Thrift core is not part of the flaw.
Affected
- Apache Thrift before 0.25.0 (Perl bindings, CPAN package Thrift)
- Distribution packages: Debian bookworm up to 0.24.0-2; Azure Linux 3 up to 0.24.0-1
Fixed in
- Apache Thrift 0.25.0
- Distribution fix: Unknown. Check the advisory of your Linux distribution.
Workaround
Unknown. No vendor workaround has been published.
Exploitation
- Apache's CISA SSVC assessment: exploitation none, not automatable, partial technical impact
- No known exploitation in the wild and no public proof of concept at the time of research
Our recommendation
- Inventory Perl applications that depend on the Thrift CPAN module.
- Check whether these services accept connections from untrusted networks and restrict access to trusted hosts.
- Upgrade to Apache Thrift 0.25.0 or to the fixed package from your distribution.
- Monitor CPU usage of affected services for unusual load.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift CVE record thread (Apache mailing list) lists.apache.org
- OSV: DEBIAN-CVE-2026-96287 osv.dev
- OSV: AZL-105944 (Azure Linux 3) osv.dev
- Apache announce list www.mail-archive.com
- OpenCVE: CVE-2026-96287 app.opencve.io
- NixOS nixpkgs issue 569828 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:11.
Original description (NVD)
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.