Apache Thrift CVE-2026-66331

Exploitation requires that the target run a service using Apache Thrift's Delphi language bindings with the buffered transport (TBufferedTransport) and that the attacker can reach that endpoint over the network; the flaw does not affect other language bindings or non-buffered transports. Per the CVSS 4.0 vector no authentication or user interaction is needed (PR:N/UI:N) against affected versions (before 0.25.0). The principal limiting factors are the narrow exposure to Delphi-based deployments specifically and the availability-only impact - there is no confidentiality or integrity consequence, so the realistic outcome is service disruption rather than compromise.

This is a medium-severity denial-of-service issue (CVSS 4.0 base 6.9) in the Delphi bindings' buffered transport of Apache Thrift, mapped to CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated trigger with no user interaction, which raises exposure, but impact is strictly availability (VC:N/VI:N/VA:L, SC/SI/SA:N) - no confidentiality or integrity loss and no scope change, so the realistic worst case is service degradation/exhaustion rather than code execution or data compromise. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuine but bounded availability risk, not a top-tier emergency - the unauthenticated network reachability justifies patching, while the availability-only, Delphi-binding-specific nature keeps real-world priority moderate. Key missing signals to note explicitly: EPSS probability is absent, KEV status is absent (not listed), and POC availability is unknown, so exploitation likelihood cannot be quantified from the provided data.

A remote attacker who can reach a service built on Apache Thrift's Delphi buffered transport sends crafted or malformed messages that cause the buffered transport to allocate memory or resources without an enforced limit. Repeated or oversized requests exhaust memory/resources and render the service unavailable to legitimate clients. No public proof-of-concept was identified in the provided data, and the impact is limited to availability (denial of service) with no code execution.