Apache Thrift CVE-2026-85476

Exploitation requires that the target application use the Apache Thrift c_glib (C/GLib) language bindings at a version before 0.25.0 AND process attacker-reachable Thrift protocol input, since the infinite loop is triggered by a crafted/malformed message during decoding. The CVSS AT:P (attack requirements) flag indicates a specific input condition must be satisfied rather than any arbitrary traffic. Key limiting factors: applications using any other Thrift language binding (Java, Python, C++, Go, etc.) are NOT affected; the attacker must be able to deliver Thrift messages to the service; and impact is confined to availability (service hang/resource exhaustion) with no data exposure or code execution. Upgrading to 0.25.0 removes the condition.

This is a denial-of-service issue (CWE-835, unreachable loop exit) in the Apache Thrift c_glib bindings, rated CVSS 8.2 via a CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H). The vector confirms a network, unauthenticated, no-user-interaction path with impact limited strictly to availability (VA:H) - there is no confidentiality or integrity impact, so the 8.2 score is driven entirely by remote-triggerable availability loss. Importantly, the vector carries AT:P (attack requirements present), signaling that exploitation is not fully unconditional and depends on a specific triggering condition, which tempers the otherwise 'network/low-complexity/no-auth' profile. No EPSS score, no POC, and no CISA KEV entry were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a legitimate but moderate-priority availability bug - real for services that expose the c_glib binding to untrusted peers, but not a confidentiality/RCE emergency; prioritize patching for internet- or partner-facing Thrift c_glib services and treat internal-only deployments as routine. No SSVC decision data was supplied in the input, so automatable/exploitation status cannot be cross-referenced.

An attacker who can send Thrift protocol messages to a service built on the vulnerable c_glib bindings submits a crafted/malformed payload that drives the decoder into a loop whose exit condition is never reached. The worker thread or process spins indefinitely (or consumes resources), rendering the service unresponsive to legitimate clients. No public proof-of-concept was identified in the provided data, and the CVSS AT:P flag indicates a specific malformed-input condition must be met to trigger the loop.