Apache Thrift CVE-2026-90440

Exploitation requires that the target application be built with the Apache Thrift D (Dlang) binding at a version before 0.25.0 AND specifically use thrift.server.nonblocking.TNonblockingServer, with that server reachable over the network. The CVSS attack requirement (AT:P) indicates a specific triggering condition - a crafted or malformed message that provokes the uncaught exception / improper resource shutdown - rather than arbitrary traffic. No authentication or user interaction is needed (PR:N/UI:N). The principal limiting factor is the narrow affected surface: only the D-language TNonblockingServer is affected, so deployments using other Thrift bindings or server types are not in scope, and impact is limited to availability (service crash/DoS) with no data exposure.

This is a denial-of-service vulnerability (CWE-248, uncaught exception / improper resource shutdown) in the D-language binding of Apache Thrift's TNonblockingServer. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue, but with an attack requirement (AT:P) indicating a specific triggering condition rather than trivial one-shot exploitation. Impact is confined entirely to availability (VA:H; VC:N, VI:N, VA:H) - there is NO confidentiality or integrity impact, so the 'Information Disclosure' tag in the input contradicts the CVSS vector and CWE and appears mislabeled. The 8.2 score is driven purely by remote unauthenticated DoS potential. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied, so there is no signal of active or widespread exploitation; this is a credible availability risk for exposed D-based Thrift services but not a confirmed in-the-wild priority. Overall: a real but availability-only concern whose practical reach is limited by the niche D binding.

A remote, unauthenticated attacker connects to a service built on the Apache Thrift D binding's TNonblockingServer and sends input that triggers an uncaught exception or improper resource shutdown, crashing or hanging the server process and denying service to legitimate clients. The attack requirement (AT:P) suggests a specific malformed message or timing condition is needed rather than arbitrary traffic. No public proof-of-concept exploit has been identified at time of analysis.