Apache Thrift CVE-2026-96990

Exploitation requires that the target run a Thrift server using the Erlang language bindings at a version before 0.25.0 AND expose that RPC endpoint to attacker-reachable (untrusted) network traffic; deployments using other language bindings (C++, Java, Python, Go, etc.) are not affected. No authentication or user interaction is needed (PR:N/UI:N), but the CVSS AT:P metric indicates a specific precondition or crafted message structure is required to trigger the unbounded allocation - it is not arbitrary traffic. Impact is limited to availability (service crash/hang); there is no confidentiality or integrity consequence. The main limiting factor is the narrow Erlang-bindings scope rather than access level.

This is a denial-of-service issue (CWE-770, Allocation of Resources Without Limits or Throttling) in the Erlang bindings of Apache Thrift before 0.25.0. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 and describes a network-reachable, unauthenticated attack with a high availability impact and NO confidentiality or integrity impact - consistent with a resource-exhaustion DoS rather than code execution or data compromise. The AT:P ('attack requirements present') metric signals that exploitation is not fully turnkey - some precondition or specific message shape is needed - which tempers the otherwise 'easy' AV:N/AC:L/PR:N profile. There is no EPSS score, no CISA KEV listing, and no public exploit reference in the supplied data, so exploitation is 'no public exploit identified at time of analysis.' The practical risk is further narrowed by scope: only deployments that actually use the Erlang language bindings of Thrift are affected, which is a small subset of the overall Thrift user base. Net assessment: a legitimately high-CVSS availability bug for the specific population running Erlang-based Thrift services, but with no evidence of active or imminent widespread exploitation; priority should be driven by whether an organization exposes Erlang Thrift endpoints to untrusted callers. Note the DoS-only impact means a high CVSS does not translate into confidentiality/integrity risk.

A remote, unauthenticated attacker who can reach a Thrift RPC endpoint built on the vulnerable Erlang bindings (before 0.25.0) sends specially shaped protocol messages that cause the server to allocate memory or other resources without enforced limits. Repeated or sufficiently crafted requests exhaust available resources and crash or hang the service, denying availability to legitimate clients. No public proof-of-concept is referenced in the available data, and the CVSS AT:P flag indicates a specific message condition is required rather than arbitrary traffic.