EUVD-2026-91398
GHSA-5q9q-jwgx-rjpw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Thrift D-bindings service over network
-
DeliverySend malformed Thrift message
-
ExploitTrigger uncaught exception / infinite loop / integer underflow
-
ExecutionService crashes or hangs
-
ImpactDenial of service to clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Exploitation requires that the target service be built using the Apache Thrift D language bindings at a version before 0.25.0 - this is the key limiting factor, as Thrift deployments using other language bindings (Java, Python, C++, Go, etc.) are not affected. The attacker must be able to deliver a crafted/malformed message to the Thrift service endpoint. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, user interaction, or special complexity is needed once network reachability to a D-bindings service exists, and no non-default configuration is indicated; impact is limited to availability (crash/hang), with no confidentiality or integrity consequences. |
| Impact | This is a denial-of-service vulnerability in Apache Thrift's D language bindings (CWE-248 uncaught exception, plus an infinite loop and integer underflow). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 8.7 indicates a remotely reachable, low-complexity, unauthenticated condition, but the impact metrics are telling: VC:N/VI:N/VA:H means availability-only impact with zero confidentiality or integrity effect. The high score is therefore driven entirely by easy remote reachability of a crash/hang, not by any code-execution or data-exposure risk. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is moderated by scope: the flaw is specific to the D language bindings, a niche binding set, so despite Apache Thrift's broad overall usage, the population of actually-affected deployments is likely small. Treat this as a genuine but availability-only DoS issue - patch promptly where D bindings are in use, but it is not a widespread emergency given the narrow affected component and absence of exploitation signals. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted Thrift message to a service built on the Apache Thrift D language bindings, triggering an uncaught exception, an infinite loop, or an integer underflow in the deserialization path. The affected service thread or process crashes or hangs, denying service to legitimate clients. No public proof-of-concept was provided, and the malformed input requires no special privileges or user interaction per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed input reaching the service endpoint triggers an uncaught exception, an infinite loop with an unreachable exit condition, and an integer underflow that can crash or hang the service. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), meaning unauthenticated remote attackers who can reach a D-bindings Thrift service need no credentials, user interaction, or non-default configuration to cause disruption. Exposure is narrow because only services compiled against the D bindings are affected - Java, Python, C++, Go and other language binding deployments are not - and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Apache Thrift to version 0.25.0 or later, which fixes the uncaught exception, infinite loop, and integer underflow in the D bindings; see the Apache advisories at https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m for details. If upgrading immediately is not possible, compensate by narrowing exposure: restrict network reachability to Thrift services built with the D bindings using firewalls or service-mesh network policies so only trusted clients can send messages (this breaks legitimate clients outside the allowlist and is impractical for public endpoints); front the service with a reverse proxy or API gateway that enforces request-size limits and rate limiting to make loop-triggering floods harder (adds latency and may not stop a single crafted message); where feasible, rebuild the affected service against a non-affected language binding or shorten request/connection timeouts and run the D-bindings service under a supervisor that restarts on hang or crash so availability is restored quickly (mitigates impact but does not remove the flaw); or temporarily retire the D-bindings endpoint until the 0.25.0 upgrade can be applied, accepting the loss of that service's functionality as the trade-off. No vendor-released patch is missing here - 0.25.0 is the exact fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC and serialization framework in which a single interface definition is compiled into language-specific client and server bindings that handle protocol framing, deserialization, and dispatch. This issue is classified under CWE-248 (Uncaught Exception) and involves two additional failure modes in the same code path: a loop with an unreachable exit condition (infinite loop) and an integer underflow/wraparound, both typical of length- or counter-based parsing logic that trusts attacker-supplied values in the message header or payload. When crafted input is parsed by the D bindings, the code either raises an exception that is not caught and therefore terminates the processing thread, spins indefinitely so the request never completes, or wraps a size/counter calculation and drives the parser into invalid state. The CPE cpe:2.3:a:apache_software_foundation:apache_thrift:*:*:*:*:*:*:*:* identifies the whole Apache Thrift product, but the vulnerable code is specifically the D language binding layer; even though the CPE is not version-qualified, EUVD records the affected range as Apache Thrift 0 through all releases before 0.25.0.
Know when Apache Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remotely reachable malformed input needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is a crash/hang only, so C:N/I:N/A:H with unchanged scope.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Executive ViewAI
Apache Thrift services built with the D language bindings can be disrupted by unauthenticated remote traffic that causes the service to crash or hang, degrading availability for any customer-facing or internal system that relies on them. Because the flaw only affects deployments compiled against the D bindings, the blast radius is limited to the small subset of our estate using that configuration, though those services can be taken offline by anyone who can reach the endpoint. Leadership should care primarily about service availability and the operational cost of unplanned outages, not data confidentiality or integrity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Thrift
View allHeap-based buffer overflow in the C++ THeaderTransport of Apache Thrift before 0.25.0 lets a remote, unauthenticated att
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attack
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a c
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed messa
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to c
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) let
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reach
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unau
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize a
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB