EUVD-2026-91399
GHSA-j57f-6rh8-9c2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Thrift PHP endpoint
-
DeliverySend malformed Thrift message
-
ExploitTrigger NULL pointer dereference
-
ExecutionCrash service process
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application use the Apache Thrift PHP bindings (version < 0.25.0) to parse Thrift protocol messages supplied by an untrusted party, and that the resulting endpoint be reachable by the attacker. The per-vector signals (AV:N/AC:L/PR:N/UI:N) indicate no authentication or user interaction is needed once such an endpoint is exposed. Limiting factors: impact is confined to availability (process crash / DoS) with no confidentiality or integrity effect; the service must actually accept and deserialize attacker-controlled Thrift input, so internal-only or non-exposed PHP Thrift consumers are not remotely exploitable. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but the impact profile is availability-only (VC:N/VI:N/VA:H), consistent with CWE-476 and the 'Denial Of Service' tag - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure DoS rather than code execution. No EPSS score, CISA KEV listing, or POC indicator is present in the input, so there is no evidence of active exploitation or public exploit code; this is currently a theoretical-but-easily-reachable DoS. The practical priority is moderate: easy to trigger if a service parses attacker-controlled Thrift messages via the PHP bindings, but the blast radius is limited to crashing the affected process rather than compromising data. No conflicting signals were detected between the vector and the description - both point to a network-reachable availability bug - though note that whether a given deployment is remotely reachable depends on how the PHP Thrift endpoint is exposed, which the input does not specify. |
| Exploit ScenarioDerived | An attacker sends a crafted or malformed Thrift protocol message to a PHP service built on Apache Thrift bindings older than 0.25.0. The message triggers a NULL pointer dereference during deserialization, crashing the handling process and denying service to legitimate clients. No public exploit code is identified in the provided data, and no authentication is required per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
RemediationAI
Vendor-released patch: upgrade to Apache Thrift 0.25.0, which the advisory states fixes the issue; any deployment compiling the PHP bindings from a release before 0.25.0 should treat this as the primary action and rebuild/redeploy dependent PHP services against the new version. Advisory details are at https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy. If an immediate upgrade is not possible, apply compensating controls based on the fact that the flaw only triggers when a PHP Thrift endpoint deserializes attacker-controlled messages: (1) place the Thrift endpoint behind a reverse proxy or API gateway that requires authentication and network-level allowlisting, which removes the unauthenticated reachability that drives the AV:N/PR:N vector - note this changes the trust model and requires client reconfiguration; (2) do not expose PHP Thrift listeners to the public internet; bind them to localhost or an internal interface and restrict source IPs - effective but only if legitimate clients are not remote; (3) run PHP-FPM/worker pools under a supervisor (systemd Restart=always, php-fpm process manager, or container restart policy) with concurrency and memory limits so a crash degrades throughput rather than taking down the whole service - this is a resilience measure, not a fix, and repeated crashes can still cause sustained DoS; (4) enforce strict message size and depth limits at the proxy or transport layer to reduce the attack surface, with the trade-off that legitimate large payloads may be rejected. None of these controls eliminate the underlying CWE-476 defect, so upgrading to 0.25.0 should be scheduled regardless of interim mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC and serialization framework in which an IDL-defined interface is compiled into language-specific client and server bindings. The PHP bindings parse and materialize Thrift protocol messages - structs, maps, lists, and primitives over binary or compact transports - inside the PHP runtime. The root cause class here is CWE-476 (NULL pointer dereference), meaning a crafted or malformed Thrift message causes the PHP binding to dereference an unset/null value during deserialization instead of failing safely, terminating the PHP process or worker. Because the affected code path is the transport/deserialization layer rather than an application-specific handler, the flaw is reachable by any peer that can send Thrift messages to an exposed endpoint, independent of authentication logic implemented above the binding. CPE data (cpe:2.3:a:apache_software_foundation:apache_thrift:*:*:*:*:*:*:*:*) and the EUVD range (Apache Thrift 0 <0.25.0) confirm that all releases before 0.25.0 are in scope across the generic Apache Thrift product entry; the practical exposure is limited to deployments that compile and run the PHP (not Java, Python, C++, etc.) bindings. The 'Denial Of Service' and 'PHP' tags corroborate the availability-only impact profile, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with the 4.0 vector - remote, low-complexity, unauthenticated, single-scope, high availability impact.
Know when Apache Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable deserialization of untrusted Thrift input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); NULL deref yields crash only, so A:H with C:N/I:N.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
NULL pointer dereference vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Executive ViewAI
Apache Thrift's PHP bindings, the component that lets PHP applications talk to Thrift-based services, contain a high-severity flaw that allows an unauthenticated remote attacker to crash any application that accepts and deserializes attacker-supplied Thrift traffic (CVE-2026-87117, CVSS 8.7). The impact is availability-only - no data can be read or altered - but affected services can be knocked offline repeatedly with little attacker effort, making this a business-continuity issue for any team running internet- or partner-reachable PHP Thrift endpoints. No public exploit code has been identified at time of analysis, so this is primarily a patch-management obligation rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Thrift
View allHeap-based buffer overflow in the C++ THeaderTransport of Apache Thrift before 0.25.0 lets a remote, unauthenticated att
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed i
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attack
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a c
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed messa
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to c
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) let
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reach
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unau
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize a
Exploit-DB