Apache Thrift EUVD-2026-91414

Requires a reachable network endpoint running an application built on an affected Apache Thrift binding (Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, or D, before 0.25.0) that deserializes attacker-controlled Thrift messages. No authentication, user interaction, or special configuration is needed (AV:N/AC:L/PR:N/UI:N) beyond the service accepting untrusted input. Exploitation is limited to availability impact (crash/memory exhaustion); it does not yield data access or code execution. Practical risk is confined to Thrift services exposed to untrusted or semi-trusted clients - internal-only services behind authenticated boundaries face reduced exposure.

This is a denial-of-service (resource exhaustion) vulnerability, not a code-execution or data-exposure flaw: the provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7 High) shows availability-only impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N). The vector is favorable to an attacker - network reachable, low complexity, no authentication, no user interaction - meaning any exposed Thrift endpoint that deserializes untrusted input can be targeted remotely by unauthenticated attackers. However, the real-world risk is bounded by the impact type: successful exploitation causes memory exhaustion / crash, not compromise of data or control. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation. Note a data conflict: the input Tags label this 'Information Disclosure,' which contradicts the CVSS vector (VC:N - no confidentiality impact); this is a resource-exhaustion/DoS issue (CWE-789), and the tag appears mislabeled. Net assessment: a credible, easily-triggerable DoS that warrants timely patching for internet- or partner-facing Thrift services, but it is an availability concern rather than a critical breach-enabling flaw.

An attacker sends a crafted Thrift message to an exposed RPC endpoint in which a declared field/collection/string size is set to an excessive value, causing the deserializer to pre-allocate a huge buffer before validating available input. The server exhausts available memory and crashes or becomes unresponsive, denying service to legitimate clients. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reach to a Thrift listener and no authentication; no public exploit code was identified at time of analysis.