EUVD-2026-49153
GHSA-x8jh-qfcv-fp29
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted Thrift message
-
ExploitTrigger integer overflow in TProtocol::checkReadBytesAvailable()
-
ImpactService crash or out-of-bounds read
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The application must use Apache Thrift C++ or c_glib bindings prior to 0.24.0 and process untrusted Thrift messages. No special configuration is required; default installations are vulnerable. |
| Impact | No CVSS score or EPSS data is available in the provided sources, and the CVE is not listed in CISA KEV. No public exploit code is known. Given the integer overflow nature, the most likely impact is a denial of service (crash) upon processing crafted input. The lack of evidence for active exploitation and the absence of proof-of-concept code suggests the real-world risk is moderate. CVSS could be high due to network attack vector and low complexity, but the actual impact appears limited to availability. |
| Exploit ScenarioDerived | A remote attacker sends a specially crafted Thrift request to a service using vulnerable bindings, triggering an integer overflow in the read-bytes check and causing the service to crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.
RemediationAI
Upgrade to Apache Thrift 0.24.0, which contains the fix. No workarounds are provided in the advisory. The official announcement is at https://seclists.org/oss-sec/2026/q3/268.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC framework. The vulnerability lies in the C++ and c_glib protocol implementations, where an integer overflow occurs when checking available read bytes (CWE-190 - Integer Overflow or Wraparound). Affected products include Apache Thrift before version 0.24.0, as identified by the vendor. No specific CPE strings were provided.
Know when Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated attacker causes denial of service; no integrity or confidentiality impact evident.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB