What is the CVSS score of CVE-2026-43868?

CVE-2026-43868 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-43868?

Yes, a patch is available for CVE-2026-43868. Update the affected software to the latest version immediately.

Apache Thrift CVE-2026-43868

EUVD-2026-27243 MEDIUM

Memory Allocation with Excessive Size Value (CWE-789)

2026-05-05

Information Disclosure Apache Java Node.js Thrift

5.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 22:30 vuln.today

CVSS changed

May 05, 2026 - 20:22 NVD

5.3 (MEDIUM)

Patch available

May 05, 2026 - 10:01 EUVD

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Apache Thrift versions prior to 0.23.0 are vulnerable to a denial-of-service condition with unspecified attack mechanisms related to CWE-789 (uncontrolled memory allocation). The vulnerability affects multiple language implementations including Rust, Java, and Node.js, and can be triggered remotely without authentication or user interaction, though the technical mechanism remains partially obscured in available disclosures. With EPSS score of 0.02% (percentile 5%), active exploitation appears unlikely despite the low CVSS complexity score.

Technical ContextAI

Apache Thrift is a cross-language RPC framework supporting code generation for multiple languages including Rust, Java, and Node.js. CWE-789 (Uncontrolled Memory Allocation) typically indicates improper input validation that allows an attacker to cause excessive memory consumption through crafted requests. The vulnerability appears to replicate patterns from CVE-2020-13949 in the Rust implementation, suggesting a memory exhaustion or allocation flaw in deserialization or message parsing logic common across Thrift's polyglot architecture. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms network-accessible, unauthenticated remote triggering with low attack complexity.

RemediationAI

Vendor-released patch: Apache Thrift 0.23.0 or later. Immediately upgrade all Thrift deployments to version 0.23.0 or the latest stable release. Organizations unable to upgrade immediately should implement request-rate limiting and memory quotas at the RPC layer, validate incoming message sizes before parsing, and monitor service memory consumption for anomalous patterns. If Thrift services are directly internet-facing, restrict network access via firewall rules to trusted clients and consider placing services behind load balancers with request filtering. Note that memory-exhaustion DoS mitigations have operational cost (false-positive rate limiting) and should be paired with application-level logging to detect actual exploitation attempts.