EUVD-2026-91630
GHSA-286c-4cxg-9ccr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Thrift C++ service
-
DeliveryCraft highly compressed/amplified payload
-
ExploitSubmit payload to deserializer
-
ExecutionTrigger unbounded resource allocation
-
ImpactExhaust memory/CPU, degrade availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Exploitation requires an application or service built on the Apache Thrift C++ bindings (versions before 0.25.0) that deserializes attacker-controlled Thrift input, because the bindings allocate resources without limits or throttling when handling highly compressed/amplified data (CWE-409). Per the CVSS vector (AV:N/PR:N/UI:N), no authentication or user interaction is needed and it is network-reachable against default configurations where the Thrift endpoint accepts untrusted input. The main limiting factor is reachability and exposure of the Thrift service to untrusted clients; impact is confined to availability (VA:L) with no data compromise, so the realistic outcome is service degradation/DoS rather than code execution or data theft. |
| Impact | This is a moderate, availability-only issue rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, but the impact is limited to availability at Low (VA:L) with no confidentiality or integrity impact (VC:N/VI:N) - consistent with CWE-409 (data amplification / decompression-bomb style resource exhaustion). The base score of 6.9 (Medium) reflects that a successful attack degrades rather than fully destroys service. No EPSS score, no CISA KEV listing, and no POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic risk is a denial-of-service against services that deserialize untrusted Thrift input using the vulnerable C++ bindings. NOTE A CONFLICT: the input Tags label this 'Information Disclosure,' but the CVSS vector (VC:N) and CWE-409 both indicate an availability/resource-exhaustion flaw, not information disclosure - the tag appears mislabeled and should not drive triage. |
| Exploit ScenarioDerived | An attacker sends a small but highly compressed or amplifiable Thrift payload to a network service built on the Apache Thrift C++ bindings (before 0.25.0). When the service deserializes the input without limits or throttling, memory/CPU consumption expands dramatically, exhausting resources and degrading or denying service to legitimate clients. No authentication or user interaction is required, but no public proof-of-concept was provided in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Unbounded resource allocation and decompression amplification in Apache Thrift's C++ bindings (all versions before 0.25.0) let remote, unauthenticated clients force excessive memory and CPU consumption by sending highly compressed or amplified Thrift payloads to a service that deserializes attacker-controlled input, degrading or denying service availability. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity loss, and no public exploit code was identified at time of analysis, so real-world risk is driven mainly by whether a Thrift endpoint is exposed to untrusted clients. No EPSS score or CISA KEV listing was supplied in the source intelligence, so no exploitation-probability or active-exploitation claim can be made.
RemediationAI
The primary fix is to upgrade Apache Thrift's C++ bindings to version 0.25.0 or later, which the vendor states resolves the issue - this is the exact vendor-released patch version and the only version-level fix identified in the source data; see the vendor advisories at https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33 for the upgrade guidance. Because no backport information was provided, teams that cannot immediately move to 0.25.0 should apply compensating controls at the service boundary: restrict the Thrift listener to trusted networks or mutual-TLS-authenticated clients (effective, but it removes legitimate external access), enforce per-connection and per-message size limits and request rate limiting at the fronting proxy or load balancer (blunts amplification payloads, but must be tuned to avoid rejecting legitimate large messages), and, where the deployment does not require compressed Thrift transports, disable or avoid compression in the configured protocol/transport so decompression amplification cannot be triggered (trade-off: higher bandwidth usage and potentially slower transfers). Running Thrift services under cgroup/container memory and CPU limits and connection-count caps converts exploitation into a process-level restart rather than node-wide exhaustion, at the cost of partial availability loss during an attack; all of these are mitigations only and none replaces upgrading to 0.25.0. No vendor-released patch other than the 0.25.0 release was identified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language interface definition and RPC/serialization framework whose C++ bindings (libthrift) implement the protocols and transports used by C++-based services to deserialize incoming requests. This entry covers an Allocation of Resources Without Limits or Throttling weakness combined with Improper Handling of Highly Compressed Data (data amplification), mapped to CWE-409: the C++ bindings process compressed or highly compressible input without enforcing expansion/size limits, so a small payload can balloon during decompression and allocation, exhausting process memory and CPU. Thrift deployments commonly use compressed transports (for example zlib- or snappy-backed variants), which is the surface where amplification-style payloads become relevant, but the advisory itself does not name a specific API; the root cause is the absence of sane bounds on allocation and decompression in the C++ binding code. The CVSS 4.0 vector supplied (AV:N/AC:L/AT:N/PR:N/UI:N, availability-limited) and the independent 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) agree that the flaw is network-reachable and unauthenticated, scoped to availability, and not a confidentiality or code-execution issue. No CPE strings were provided in the input data, so the exact platform matrix is derived from the vendor's version statement (before 0.25.0) rather than from CPE enumeration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable, low-complexity, unauthenticated deserialization of untrusted data; impact limited to availability (resource exhaustion), so C:N/I:N and A:L.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB