EUVD-2026-49157
GHSA-jx7g-767m-86hp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend a crafted Thrift binary message with an artificially large string length
-
ExploitReach the non-strict deserialization path in the Rust parser
-
ExecutionTrigger unbounded memory allocation
-
ImpactExhaust system memory and crash the service process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected Thrift service must be built with Rust bindings, use the binary protocol, and have the non-strict parsing path enabled. This is the default mode only when the protocol is configured for non-strict deserialization. Services running the binary protocol in strict mode are not vulnerable. No specific authentication or user interaction is required - the attacker only needs to be able to send messages to the Thrift endpoint. The vulnerability is limited to the Rust implementation; other language bindings are unaffected. |
| Impact | No CVSS vector or EPSS score is available from the advisory or NVD. The vulnerability permits network-level denial of service with likely low attack complexity and no authentication requirement, which would typically correspond to a High severity base score (AV:N/AC:L/PR:N/UI:N). However, lack of exploitation indicators (no KEV listing, no known POC) reduces the immediate real-world urgency. This is a DoS-only issue without data confidentiality or integrity impact, limiting the overall risk compared to remote code execution. Risk is moderate for unprotected, externally facing Thrift services that use the Rust binary protocol in non-strict mode; internal services or those behind authentication are at lower real-world exposure. |
| Exploit ScenarioDerived | An attacker sends a maliciously crafted Thrift binary protocol payload with an overly large string field to a service using the vulnerable Rust binding in non-strict mode. The parser allocates an unbounded amount of memory for the string, eventually consuming all available resources and causing the service to crash. No public proof-of-concept code is available, but constructing such a payload is straightforward given the missing limit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory by sending crafted binary protocol messages that lack a string size limit when the non-strict path is used. Successful exploitation can crash the affected service. No active exploitation or public exploit code is currently reported.
RemediationAI
Upgrade to Apache Thrift 0.24.0, which includes the enforced string size limit. As a temporary workaround, switch the Rust binary protocol to strict mode if feasible, though this may break compatibility with clients that rely on non-strict parsing. Restrict network access to Thrift services to trusted clients to reduce exposure. Monitor service memory usage and configure operating system limits (e.g., cgroups, ulimit) to mitigate resource exhaustion in the event of an attack. The oss-security advisory provides the upgrade recommendation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC framework with code generation and a binary serialization protocol. The Rust binding's binary protocol implementation, when operating in non-strict mode, fails to enforce a maximum size on strings during deserialization, allowing unbounded memory allocation (CWE-770). The vulnerable component is specific to the Rust binary protocol's non-strict execution path, which differs from the strict mode that imposes size constraints. Affected CPE: thrift library, versions <0.24.0 (exact CPE string not provided).
Know when Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network attack against unauthenticated service; no user interaction; only availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB