Apache Thrift EUVD-2026-91367

Exploitation requires the target service to use Apache Thrift (before 0.25.0) with the THeaderTransport transport layer exposed to attacker-reachable input; THeaderTransport is a common choice for Thrift RPC, so many deployments qualify. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration beyond using the affected transport is needed - an unauthenticated remote attacker can send the triggering messages against default-reachable Thrift endpoints. The practical limiting factor is network exposure of the Thrift service and whether THeaderTransport is in use; impact is confined to availability (resource/memory exhaustion), with no confidentiality or integrity consequences.

This is a resource-exhaustion (memory leak) flaw in Apache Thrift's THeaderTransport, rated CVSS 8.7 (4.0) with vector AV:N/AC:L/AT:N/PR:N/UI:N and an impact profile of VA:H only (VC:N/VI:N/VA:H) - i.e. pure availability impact, no confidentiality or integrity loss. CWE-401 (missing release of memory after effective lifetime) confirms the core issue is unreleased memory/resources that an unauthenticated remote attacker can trigger repeatedly over the network, consistent with the low-complexity network vector. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.7 is driven by ease of reach (remote, unauth, low complexity) rather than by severity of outcome (availability-only). Realistically this is a denial-of-service priority for internet-facing or multi-tenant Thrift RPC endpoints - meaningful but lower urgency than a code-execution or data-disclosure bug of similar score. Note a signal tension: the input Tags include 'Information Disclosure', which conflicts with the CVSS impact (VC:N means no confidentiality impact) and the CWE-401 memory-leak classification - the vulnerability is an availability/resource-leak issue, not information disclosure, so the tag appears mislabeled.

An attacker repeatedly opens connections to a network-exposed service built on Apache Thrift and sends crafted THeaderTransport messages that cause memory/resources to be allocated but never freed. Sustained over many requests, this exhausts server memory and degrades or crashes the service, denying availability to legitimate clients. No public proof-of-concept was identified in the provided data.