EUVD-2026-49157
GHSA-jx7g-767m-86hp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack against unauthenticated service; no user interaction; only availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory by sending crafted binary protocol messages that lack a string size limit when the non-strict path is used. Successful exploitation can crash the affected service. No active exploitation or public exploit code is currently reported.
Technical ContextAI
Apache Thrift is a cross-language RPC framework with code generation and a binary serialization protocol. The Rust binding's binary protocol implementation, when operating in non-strict mode, fails to enforce a maximum size on strings during deserialization, allowing unbounded memory allocation (CWE-770). The vulnerable component is specific to the Rust binary protocol's non-strict execution path, which differs from the strict mode that imposes size constraints. Affected CPE: thrift library, versions <0.24.0 (exact CPE string not provided).
RemediationAI
Upgrade to Apache Thrift 0.24.0, which includes the enforced string size limit. As a temporary workaround, switch the Rust binary protocol to strict mode if feasible, though this may break compatibility with clients that rely on non-strict parsing. Restrict network access to Thrift services to trusted clients to reduce exposure. Monitor service memory usage and configure operating system limits (e.g., cgroups, ulimit) to mitigate resource exhaustion in the event of an attack. The oss-security advisory provides the upgrade recommendation.
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today