Apache Thrift Ruby CVE-2026-96277

Exploitation requires a service that uses the Apache Thrift Ruby bindings (version before 0.25.0) to expose a network-reachable Thrift RPC endpoint that processes attacker-supplied protocol messages. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are needed - any reachable Thrift Ruby service parsing untrusted input is exposed. The primary limiting factor is deployment scope: only services specifically built on the Ruby language bindings are affected (not Thrift bindings for other languages), and impact is limited to availability (service crash/DoS) with no data exposure or code execution. Upgrading to 0.25.0 removes the condition.

This is a denial-of-service vulnerability (CWE-248 Uncaught Exception / Improper Handling of Exceptional Conditions) in the Apache Thrift Ruby bindings. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) tells a consistent story: network-reachable, low complexity, no privileges or user interaction, with impact confined entirely to availability (VA:H) and zero confidentiality or integrity impact (VC:N/VI:N). The 8.7 score is driven solely by easy, unauthenticated remote triggering of a crash, not by data exposure or code execution. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - this appears to be a real but availability-only priority rather than a critical compromise vector. Importantly, the 'Information Disclosure' tag in the input directly CONFLICTS with the CVSS vector, which shows VC:N (no confidentiality impact); the vector indicates this is a DoS, not an information-disclosure flaw, and the tag should be treated as mislabeled. Priority should be scaled to how exposed the Thrift Ruby service endpoints are and whether availability of those RPC services is business-critical.

A remote attacker sends a malformed or crafted Thrift protocol message to a network-exposed service built on the Apache Thrift Ruby bindings. The library fails to properly handle the exceptional condition, raising an uncaught exception that terminates the handler or process, denying service to legitimate clients. No public exploit code was identified in the provided intelligence, and no authentication is required (PR:N).