EUVD-2026-91628
GHSA-h4r6-c5rr-jcwm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Thrift Go endpoint
-
DeliverySend crafted oversized protocol message
-
ExploitTrigger unbounded resource allocation
-
ExecutionExhaust server memory/CPU
-
ImpactService denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component must be an application using the Apache Thrift Go bindings at a version before 0.25.0 that accepts Thrift protocol messages over the network from untrusted or semi-trusted clients. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special attack prerequisites are required - any reachable Thrift Go server endpoint is exposed. The primary limiting factor is network reachability: services that only accept Thrift traffic from trusted internal peers or behind authenticated gateways have a materially smaller exposure, and the impact is confined to availability (service crash/exhaustion) with no data confidentiality or integrity consequence. |
| Impact | This is a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vector with no special attack requirements, and the impact profile is availability-only (VC:N/VI:N/VA:H) - consistent with CWE-770 (Allocation of Resources Without Limits or Throttling), a classic denial-of-service weakness. The 8.7 base score is driven entirely by the ease of reaching the flaw, not by confidentiality or integrity loss. Mitigating the urgency: there is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no evidence of active or imminent exploitation. In short, high exploitability on paper but no confirmed real-world exploitation signal - treat as a solid patch priority for internet-facing Thrift Go services rather than an emergency. Note the limits of the data: the only references are two Apache mailing-list threads with no titles, and no independent advisory text beyond the NVD description was provided, so the precise trigger (e.g. message/field size handling) could not be confirmed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted Thrift protocol messages to a service built on the Apache Thrift Go bindings, where the message causes the server to allocate memory or other resources without bound. Repeated or single oversized requests exhaust server memory/CPU, crashing the process or rendering it unresponsive to legitimate clients. No public exploit code was identified at time of analysis, but the low attack complexity makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Denial of service in the Go language bindings of Apache Thrift affects all versions before 0.25.0, where resources are allocated without limits or throttling, allowing a remote unauthenticated client to exhaust server memory or other resources and take down the service. Per the assessed vector (AV:N/AC:L/PR:N/UI:N, availability-only impact), any Thrift Go server endpoint reachable over the network is exposed, with no confidentiality or integrity consequence; the practical exposure is narrowed by network reachability and by whether the deployment accepts Thrift traffic from untrusted clients. CISA KEV does not list this issue and no public exploit code was identified at time of analysis, so exploitation appears to require only a crafted or excessive-volume Thrift message rather than a published attack tool.
RemediationAI
Vendor-released patch: upgrade Apache Thrift to version 0.25.0, which the advisory states fixes the issue; for Go services this means bumping the github.com/apache/thrift module (and any vendored copy) to 0.25.0 or later, rebuilding, and redeploying, then verifying the running binary no longer links the vulnerable version. Where an upgrade cannot be performed immediately, compensating controls should target the unauthenticated network reachability that the assessed vector depends on: place the Thrift endpoint behind a network ACL, service mesh, or API gateway that only admits known clients, accepting that this trades exposure reduction for operational coupling to the proxy and does not protect against a compromised or misbehaving trusted peer. Additional hardening includes capping inbound message or frame sizes at the transport layer, limiting concurrent connections and per-connection read timeouts at a reverse proxy or load balancer, and applying process-level memory limits (for example container memory ceilings with restart policies) so an allocation spike degrades a single replica instead of the host; each of these can cause legitimate large-payload or long-lived Thrift calls to fail and must be tuned against real traffic. Monitoring for sharp memory growth or connection-count spikes on Thrift Go listeners gives early warning, and the official guidance and fix confirmation are in the Apache announcement threads at https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/6kpzdw29gsfxptv4b65y9s6f42tdyo8k.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC and serialization framework in which an IDL definition generates client and server stubs for a target language; the Go bindings (lib/go) implement the transport, protocol, and server layers used by Go services that expose Thrift endpoints. The root cause class is CWE-770, Allocation of Resources Without Limits or Throttling: inbound protocol messages are processed in a way that permits unbounded consumption of memory or similar resources per connection or per request, so a peer can drive allocation past available capacity instead of being constrained by a size, rate, or concurrency cap. Because the flaw sits in generated-binding/library code rather than in application business logic, it is inherited by every Go service built against an affected Thrift release, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) places it squarely in the availability-only denial-of-service class with no authentication or user-interaction prerequisite. The provided references point to Apache Software Foundation mailing-list announcement threads, which are the canonical disclosure channel for the fix; no CPE strings were supplied, so affected-scope identification must rely on the version boundary stated in the advisory. Note that the same fixed release may address related issues across other language bindings, so confirming the Go binding specifically is the relevant check for this CVE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable, low-complexity, unauthenticated resource-exhaustion DoS (CWE-770), so AV:N/AC:L/PR:N/UI:N with availability-only impact A:H and no C/I effect.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Executive ViewAI
Apache Thrift's Go language bindings - an RPC layer embedded in many internal and customer-facing services - can be driven into a full outage by an unauthenticated network client in every release prior to 0.25.0. Any team exposing Go-based Thrift endpoints to untrusted networks should treat this as an availability risk to revenue-generating or customer-facing services, because a sustained flow of crafted Thrift messages can exhaust server memory and force restarts. There is no confidentiality or data-integrity exposure, and no public exploit code or confirmed active exploitation has been observed, so this is a resilience and capacity-planning issue rather than an active-breach incident.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of Go-based Thrift endpoints to trusted clients via firewall rules, security-group segmentation, or an authenticated API gateway; enforce per-connection concurrency caps, request rate limits, and maximum message/frame sizes at the load balancer or proxy layer; apply container or cgroup memory limits, request timeouts, and circuit breakers so one endpoint cannot exhaust host resources; deploy memory and connection-count alerting with automatic restart or failover; and validate these controls with controlled load testing before relying on them.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB