EUVD-2026-91584
GHSA-3rvm-c477-m8mc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Thrift c_glib service over network
-
DeliverySend malformed/crafted Thrift message
-
ExploitTrigger NULL pointer dereference
-
ExecutionCrash service process
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to be built on Apache Thrift's c_glib (C/GLib) language bindings at a version before 0.25.0; other language bindings are not affected by this issue. The attacker must be able to reach the Thrift service over the network and send it a crafted or malformed message that reaches the vulnerable deserialization/parsing path. Limiting factors: impact is restricted to denial of service (process crash) with no data exposure or code execution, and only the c_glib binding is vulnerable, which narrows the real-world exposed surface compared to Thrift's more commonly used bindings. |
| Impact | Signals are moderately consistent but point to a DoS-only issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) purely on the strength of a remote, unauthenticated, low-complexity trigger, but the impact is confined to availability (VA:H) with no confidentiality or integrity loss (VC:N/VI:N) - consistent with the CWE-476 NULL pointer dereference and use-of-uninitialized-variable root cause. There is no CISA KEV listing and no POC referenced, so exploitation status is 'no public exploit identified at time of analysis'; EPSS was not provided and cannot be cited. The 8.7 score should be read with the caveat that it reflects a crash/denial-of-service, not code execution, so the practical priority is lower than the headline number for most operators. A key scoping nuance: the flaw is specific to the c_glib (C/GLib) bindings, so environments using Java, Python, C++, Go, or other Thrift bindings are not affected by this issue even though the CPE lists Apache Thrift generically. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted or malformed message to a service built on Apache Thrift's c_glib bindings, triggering a NULL pointer dereference or use of an uninitialized variable. This crashes the server process, causing a denial of service. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.
RemediationAI
Upgrade Apache Thrift to 0.25.0 or later; this is the vendor-released fixed version and applies to the c_glib binding identified in the advisory (https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o). If the upgrade cannot be staged immediately, reduce exposure by firewall or service-mesh rules that allow only known, trusted Thrift clients to reach the listener instead of exposing it broadly, since the vector is unauthenticated and the only precondition is delivering a malformed message to the parser; the trade-off is loss of legitimate third-party or dynamic client access. Run the Thrift service under a supervisor that restarts on failure (for example systemd with Restart=on-failure) and alert on abnormal exits, accepting that an attacker who keeps sending crafted payloads can repeatedly induce restarts and sustained availability loss. Because the defect is confined to the c_glib binding, migrating the service to a different Thrift binding (for example the C++ or Go binding) eliminates this specific crash path but requires recompiling and re-testing the service. Adding a validating proxy or strict message-size and framing limits in front of the Thrift endpoint can filter obviously malformed payloads, though it is only a partial mitigation as it does not fix the underlying NULL/uninitialized dereference in the binding code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC and serialization framework in which a single IDL definition is compiled into per-language bindings, and c_glib is the binding generated for C programs using the GLib/GObject runtime. The vulnerability (CWE-476, NULL pointer dereference, compounded by use of an uninitialized variable) lives in that C/GLib binding's protocol parsing and message deserialization code: when a malformed or truncated Thrift message is processed, a pointer or field that the code assumes is populated is instead NULL or uninitialized, and dereferencing it aborts the process. Because the flaw is in binding-specific generated/runtime C code rather than in the wire protocol or the shared IDL compiler, it does not extend to the Java, Python, Go or other bindings. The affected component is captured by CPE cpe:2.3:a:apache_software_foundation:apache_thrift:*:*:*:*:*:*:*:* and confirmed by EUVD-2026-91584 as Apache Thrift 0 < 0.25.0. The CVSS:4.0 vector (VC:N/VI:N/VA:H, SC:N/SI:N/SA:N) corroborates that the sole impact is availability loss through a crash, with no memory-corruption-to-code-execution or data-disclosure pathway indicated.
Know when Apache Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated trigger with low complexity (AV:N/AC:L/PR:N/UI:N); NULL deref yields crash only, so A:H with C:N/I:N and no scope change.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Executive ViewAI
Apache Thrift services built with the c_glib (C/GLib) bindings prior to version 0.25.0 can be crashed by a single malformed network message, allowing any unauthenticated party with network reachability to repeatedly terminate those services. Only availability is affected - no data exposure or tampering - but organizations running internet- or partner-facing Thrift endpoints on this binding should treat sustained outages and service flapping as a realistic near-term risk. Leadership should note that other Thrift language bindings are unaffected, so remediation scope is limited to teams running C/GLib-based services.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Thrift
View allHeap-based buffer overflow in the C++ THeaderTransport of Apache Thrift before 0.25.0 lets a remote, unauthenticated att
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed i
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attack
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a c
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to c
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) let
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reach
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unau
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize a
Exploit-DB