Apache Thrift Erlang bindings: Allocation of resources without limits in JSON protocol
Summary
The Erlang bindings of Apache Thrift before 0.25.0 use the thrift_json_protocol module, which reads an entire message without a size limit. A remote attacker who can send messages to an affected Erlang Thrift service can exhaust memory or processing resources and cause a denial of service. No authentication is required according to the CVSS vector, but the attack conditions depend on the service being exposed to the attacker.
Affected
- Apache Thrift before 0.25.0 (Erlang bindings, thrift_json_protocol)
- Affected range per CNA: 0 to < 0.25.0
- Distribution packages: Azure Linux 3 lists thrift 0.24.0-1 as the last affected version
- Debian: affected versions listed in OSV, fixed version unknown
Fixed in
- Apache Thrift 0.25.0
- openSUSE: libthrift-0_25_0-0.25.0-1.1 (per aggregator)
- Debian, Ubuntu and other distributions: Unknown.
Workaround
- None documented by the vendor.
- If an upgrade is delayed, restrict which clients can reach the Erlang Thrift endpoint and enforce message size limits at the network or proxy layer (recommendation of the research, not from the vendor).
Exploitation
- No evidence of in-the-wild exploitation found.
- Not listed in CISA KEV according to one aggregator.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No public exploit code confirmed.
Our recommendation
- Inventory Erlang-based Thrift services and their Apache Thrift or distribution package versions.
- Upgrade to Apache Thrift 0.25.0 or a distribution package that includes the fix.
- Limit exposure of affected endpoints to trusted clients until patched.
- Re-check NVD and the Apache advisory, as the record is still under analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread 1 lists.apache.org
- Apache mailing list thread 2 lists.apache.org
- NVD record via Vulners vulners.com
- OSV Debian entry osv.dev
- OSV Apache Thrift entry osv.dev
- OSV Azure Linux entry osv.dev
- Apache Thrift CHANGES.md apache.googlesource.com
- OpenCVE CVE-2026-96990 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:24.
Original description (NVD)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.