Apache Thrift CVE-2026-120135

Requires a Java service using Apache Thrift (libthrift) before 0.24.0 that deserializes attacker-reachable Thrift input and invokes TProtocolUtil.skip() on unknown/unexpected fields - this is default skipping behavior, so no special configuration is needed and no authentication is indicated (PR:N). Exploitation is limited to the Java bindings specifically, and the impact is bounded to availability (stack-exhaustion DoS) with no confidentiality or integrity effect; the endpoint must accept attacker-supplied serialized Thrift data, so services that only exchange Thrift messages between trusted internal peers face materially lower real-world exposure. The only complete fix per the advisory is upgrading to 0.24.0.

The supplied CVSS 4.0 vector (8.2 high, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) describes a network-reachable, low-complexity, unauthenticated flaw whose entire impact is availability (VA:H) - this is a denial-of-service through uncontrolled recursion, with no confidentiality or integrity consequence. That single-dimension impact is the key nuance: despite the high base score, a successful attack crashes a service rather than exposing data or granting code execution. The decision signals are thin and consistent with low immediate urgency: the vuln.today Decision label is 'awaiting_data', there is no CISA KEV listing, no EPSS score is provided, and no exploit/PoC reference appears in the input - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore concentrated on internet-exposed or multi-tenant Java Thrift services that deserialize untrusted input; for internal-only RPC between trusted services the real-world exposure is considerably lower. Note one tension to verify: the official vector uses AT:P (an attack requirement), but the described trigger - an attacker-crafted, deeply nested serialized message - appears to be fully within attacker control against default behavior, which would argue for AT:N; confirm the intended attack requirement with the vendor advisory.

An attacker sends a specially crafted, deeply nested serialized Thrift message to a Java service built on libthrift before 0.24.0. When the service processes unknown or unexpected fields, TProtocolUtil.skip() recurses without a default depth limit, exhausting the thread stack and crashing or hanging the service (denial of service). No public exploit code is identified in the provided sources.