Apache Thrift CVE-2026-96288

Exploitation requires that the target run a service using the Apache Thrift Erlang bindings (version before 0.25.0) and accept attacker-reachable Thrift-serialized input over the network; the attacker then sends a maliciously structured message (deeply nested/recursive or otherwise resource-heavy) that the Erlang deserialization code processes without recursion-depth or resource limits. LIMITING FACTORS: the CVSS AT:P metric indicates a required attack condition not fully under the attacker's control (notably, the endpoint must actually parse the untrusted payload), the affected component is specifically the Erlang bindings rather than all Thrift language bindings, and impact is confined to availability (service crash/hang) with no data compromise. No authentication is required (PR:N) and no user interaction is needed (UI:N).

This is a moderate-priority availability flaw rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scoring 8.2 indicates a network-reachable, unauthenticated issue, but the impact metrics are the decisive signal: only VA:H (availability high) with VC:N and VI:N - this is a pure denial-of-service condition (CWE-674 uncontrolled recursion plus allocation of resources without limits/throttling), with no confidentiality or integrity impact. The AT:P (attack requirements present) qualifier signals that successful exploitation depends on a condition beyond the attacker's sole control, which modestly lowers real-world likelihood versus a frictionless AT:N DoS. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a disclosed-and-patched vendor advisory, not an observed campaign. CONFLICTING SIGNAL: the input Tags include 'Information Disclosure', which directly contradicts both the CWE and the CVSS vector (VC:N = no confidentiality impact); this appears to be a mislabeled tag, and the actual risk is service disruption, not data exposure.

An attacker sends a specially crafted Thrift message (for example a deeply nested or recursively structured payload) to a service built on the Apache Thrift Erlang bindings. The parser recurses without bound and allocates resources without throttling, exhausting the stack, memory, or scheduler capacity and crashing or hanging the service. No public exploit code was identified in the provided data, and the AT:P qualifier implies the target must be processing attacker-reachable Thrift input under a condition the attacker cannot fully guarantee.