What is the CVSS score of CVE-2026-66081?

CVE-2026-66081 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-66081?

Within 24 hours, identify all Thrift deployments using the c_glib binding and verify whether versions are below 0.25.0; for any internet-facing or untrusted-network-accessible c_glib Thrift endpoints, immediately restrict network access via firewall rules or disable the endpoint until patched. Within 7 days, apply the vendor-released patch by upgrading all c_glib bindings to version 0.25.0 or later, and validate that no vulnerable versions remain in build pipelines or container images. Within 30 days, complete the upgrade across all remaining environments, update software bills of materials and vulnerability management records, and review whether c_glib is required for business functions or can be replaced with a less exposed binding; implement network segmentation to limit future Thrift endpoint exposure.

Apache Thrift CVE-2026-66081

Q: Which versions of Apache Thrift are affected by CVE-2026-66081?

Apache Thrift's c_glib (C/GLib) binding prior to version 0.25.0 exposes organizations to remote, unauthenticated denial-of-service attacks that can crash applications using that binding.. A patch is available.

EUVD-2026-91588 HIGH

Access of Uninitialized Pointer (CWE-824)

2026-10-02 apache

GHSA-v446-56hp-jpw2

Apache Information Disclosure Memory Corruption Red Hat Suse Apache Thrift Apache Software Foundation

8.7

CVSS 4.0 · Vendor: apache

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Thrift c_glib service over network
Exploit

Send crafted/malformed Thrift message
Execution

Trigger access of uninitialized pointer
Impact

Crash or destabilize service (DoS)

Vulnerability Assessment

Weakness	CWE CWE-824 ASVS 5.0 V15 - Secure Coding and Architecture Uninitialized pointer prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the target application to be built against Apache Thrift's c_glib (C/GLib) language bindings specifically (deployments using Java, Python, Go, or other bindings are not affected) and to be running a version before 0.25.0 while processing attacker-reachable Thrift protocol input. No authentication, user interaction, or non-default toggle is indicated by the CVSS vector (PR:N/UI:N/AC:L). The principal limiting factors are therefore the use of the c_glib binding and exposure of the Thrift endpoint to the attacker; impact is bounded to availability (service crash), not data disclosure or code execution.
Impact	The provided CVSS 4.0 score of 8.7 (High) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) flaw whose sole impact is to availability (VA:H), with no confidentiality or integrity impact (VC:N/VI:N). This profile - an Access of Uninitialized Pointer (CWE-824) - is consistent with a remotely-triggerable crash/denial-of-service rather than code execution or data theft. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is therefore moderate: the vector is attractive (remote, unauthenticated, low complexity) but the capped availability-only impact and absence of exploitation signals place this below critical-severity RCE/disclosure issues. NOTE A CONFLICT: the input Tags assert 'Information Disclosure' and 'Memory Corruption', yet the authoritative CVSS 4.0 vector sets VC:N (no confidentiality impact), meaning the disclosure characterization is not supported by the scored impact - treat 'Information Disclosure' as unverified and prioritize this as a DoS/stability risk pending vendor clarification.
Exploit ScenarioDerived	An attacker who can reach a network service built on Apache Thrift's c_glib (C/GLib) bindings sends a crafted or malformed Thrift protocol message that causes the server to dereference an uninitialized pointer. Because the flaw requires no authentication, no user interaction, and low attack complexity, a single remote request can crash or destabilize the service, producing a denial of condition. No public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 02, 2026

Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.

RemediationAI

Upgrade to Apache Thrift 0.25.0, the vendor-released fix for this issue, updating both the c_glib native library and any IDL-generated glue code, then rebuild and redeploy the affected application so the patched binding is actually linked. If an immediate upgrade is not feasible, restrict exposure of the Thrift endpoint: place it behind network ACLs, a reverse proxy, or mutual-TLS client allowlisting so only trusted peers can deliver protocol input, accepting that this breaks legitimate remote clients until the restriction is lifted. Where the architecture permits, migrating the service to a binding that does not contain this defect (Java, Python, Go, and others) removes the exposure entirely while staying on the same release, at the cost of re-implementation or re-generation effort. Add crash supervision at the deployment layer - systemd restart policies, a process manager, or redundant load-balanced replicas - to shorten the availability window when a malformed message terminates a worker, recognizing that this reduces but does not eliminate the denial-of-service effect. Both vendor advisories at https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57 should be consulted for the authoritative fix confirmation.

Affected VersionsENISA

Apache Thrift 0 <0.25.0

Affected Packages

euvd apache_thrift fix: 0.25.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Apache Thrift is a cross-language RPC and serialization framework whose compiler generates language-specific client and server code from an IDL definition; the c_glib binding produces C code layered on GLib/GObject and ships as a native library consumed by C or GLib-based services. CWE-824 (Access of Uninitialized Pointer) means a pointer variable or structure member is dereferenced or freed before a valid value has been assigned, yielding undefined behavior that in practice manifests as a segmentation fault or abort of the hosting process. Because the defect is reached while parsing or dispatching Thrift protocol messages, exploitation requires the target application to be compiled against the c_glib binding and to accept protocol input from a network source; the vendor vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N and the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H agree on a network-reachable, low-complexity, unauthenticated, no-interaction condition whose only demonstrated effect is loss of availability. The source tag set mentions 'Memory Corruption' and 'Information Disclosure', but nothing in the advisory data or the assessed vector supports data disclosure or code execution - VC:N/VI:N and the absence of any confidentiality or integrity outcome bound the practical result to a denial of service. The vendor CPE cpe:2.3:a:apache_software_foundation:apache_thrift:*:*:*:*:*:*:*:* spans the whole product family, yet the vulnerable code path is specific to c_glib, so same-version deployments on other bindings inherit the version number but not the exposure.

Know when Apache Thrift gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.5 HIGH

Remotely reachable Thrift endpoint, no auth or interaction (AV:N/AC:L/PR:N/UI:N); uninitialized pointer access yields a crash, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat HIGH

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Oct 02, 2026 - 13:02 EUVD

CVE Published

Oct 02, 2026 - 12:33 cve.org

HIGH 8.7

DescriptionCVE.org

Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Executive ViewAI

Why It Matters

Apache Thrift's c_glib (C/GLib) binding prior to version 0.25.0 exposes organizations to remote, unauthenticated denial-of-service attacks that can crash applications using that binding. Only services built on c_glib and reachable from untrusted networks are affected, while Java, Python, and Go deployments are not. Leadership should direct remediation of externally facing C/GLib-based Thrift endpoints, as no public exploit code has been identified at time of analysis, but the flaw's high availability impact warrants prompt attention.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 65% exploitable

Prevalence

Medium

Apache Thrift is popular, but the c_glib C/GLib binding is a specific, less-common binding

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.