Apache Thrift EUVD-2026-91561

The target must run a service using the Apache Thrift Go bindings (before 0.25.0) that accepts attacker-supplied compressed data - i.e., a compressed transport layer (such as zlib) is in use and reads untrusted input. The CVSS 'AT:P' metric reflects this: exploitation is not possible against configurations that do not accept compressed input over the affected transport. Limiting factors: impact is availability-only (service crash/hang, no code execution or data exposure), and services not deployed with the Go bindings or not accepting external compressed payloads are not exposed. No authentication (PR:N) or user interaction (UI:N) is required where the condition holds.

This is a denial-of-service vulnerability (CWE-409 data amplification / decompression bomb) in the Apache Thrift Go bindings. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 and is internally consistent with a resource-exhaustion DoS: network-reachable, unauthenticated, no user interaction, with impact confined to availability (VA:H) and zero confidentiality or integrity impact (VC:N/VI:N). The 'AT:P' (Attack Requirements: Present) metric signals that exploitation is not entirely condition-free - a specific precondition (a compressed transport accepting untrusted input) must hold - which tempers the otherwise fully-remote profile. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation; status is 'no public exploit identified at time of analysis.' Note a tagging conflict: the input Tags include 'Information Disclosure,' which contradicts the CVSS vector (VC:N - no confidentiality impact) and the CWE - this is an availability/DoS issue, not disclosure, and the tag appears mislabeled. Overall this is a legitimately high-scoring availability bug but not an emergency: the impact is DoS only (no RCE or data theft), no exploitation is confirmed, and a straightforward vendor patch exists. Prioritize for prompt patching on internet-exposed Thrift Go services rather than as a drop-everything incident.

An attacker sends a small, highly compressed (e.g., zlib) Thrift payload to a network-reachable service built on the vulnerable Go bindings; on decompression the data expands enormously, exhausting memory or CPU and crashing or hanging the service. No authentication or user interaction is required, but the service must be accepting untrusted compressed input. No public exploit code was identified at the time of analysis.