Apache Thrift EUVD-2026-91405

Exploitation requires that an application use the Apache Thrift c_glib (C/GLib) bindings at a version before 0.25.0 to deserialize attacker-controlled input; the attacker must be able to deliver a crafted message with deeply nested structures to a Thrift deserialization path. Limiting factors: the flaw is confined to the c_glib bindings, so deployments using other language bindings (Java, Python, C++, etc.) are not affected by this specific issue, and the CVSS attack requirement (AT:P) indicates exploitation depends on the vulnerable recursive parsing path being reachable with untrusted input rather than succeeding unconditionally. Impact is limited to denial of service - there is no confidentiality or integrity consequence.

This is a denial-of-service (availability-only) flaw: the provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) confirms no confidentiality or integrity impact, only high availability impact, reachable over the network without authentication but with an attack requirement (AT:P) - consistent with CWE-674 Uncontrolled Recursion, where an attacker supplies deeply nested serialized data to exhaust the stack and crash the process. The base score of 8.2 is driven almost entirely by VA:H plus the network, no-privilege, no-interaction profile, not by any data-compromise potential, so despite the 'high' severity this is a crash/outage risk rather than a code-execution or data-breach risk. No EPSS score, no CISA KEV listing, and no POC are present in the input, so exploitation probability signals are entirely absent - there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a data conflict: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (VC:N, VA:H) - this is an availability/DoS issue, not disclosure, and the tag appears mislabeled. Real-world priority is moderate: patch promptly where the c_glib bindings parse untrusted input, but absent exploit evidence this is not an emergency on the level of an RCE.

A remote, unauthenticated attacker sends a specially crafted Thrift message containing deeply or recursively nested structures to a service built on the Apache Thrift c_glib bindings. The parser recurses without bound while deserializing, exhausting the stack and crashing the server process, producing a denial of service. No public exploit code is identified at time of analysis, and the CVSS attack requirement (AT:P) suggests success may depend on reaching a vulnerable deserialization path with attacker-controlled input.