Apache Thrift EUVD-2026-91581

Affected deployments must run a service using the Apache Thrift Go bindings (versions before 0.25.0) with either the TFramedTransport or THeaderTransport transport - both are standard, commonly-used Thrift transports, so this is close to a default-configuration condition rather than a niche setting. Exploitation requires only that an attacker can reach the Thrift listener and send a single crafted frame (a declared-size-zero framed frame, or a header-filling THeader frame); no authentication (PR:N) and no user interaction (UI:N) are needed. The primary limiting factor is network exposure and peer trust: services that only accept connections from trusted internal peers face materially lower realistic risk, while internet-facing or multi-tenant endpoints are directly exploitable.

This is a genuine availability-only denial-of-service issue, not a high-CVSS-but-low-real-risk inflation. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, low-complexity, unauthenticated path, and the impact profile (VC:N/VI:N/VA:H) correctly reflects that only availability is affected - no confidentiality or integrity loss. The score of 8.7 is driven entirely by the ease of remotely crashing the process. Crucially, the crash occurs via a Go stack-overflow 'fatal error' that recover() cannot intercept, so the entire process dies rather than a single goroutine - this materially raises real-world impact for single-process Go services. No EPSS score, KEV listing, or POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' However, the trigger is trivially constructible (a 4-byte TFramedTransport frame declaring size zero, or an 18-byte THeaderTransport frame), so weaponization difficulty is very low and an EPSS uplift would be unsurprising once scored. Priority should be treated as moderate-to-high for any internet-facing or untrusted-peer Thrift Go service, and lower where peers are fully trusted.

An attacker connects to an internet-exposed Apache Thrift service built on the Go bindings and sends a specially crafted framed message - a TFramedTransport frame declaring a payload size of zero, or a THeaderTransport header block that exactly fills the frame. The server reads the empty frame, fetches the next frame, and recursively calls Read with no bound, driving the Go stack to its limit and triggering an uncatchable fatal error that terminates the whole process. No authentication or user interaction is required, and no public exploit code was provided in the input, though the trigger is trivial to reproduce.