Apache Thrift
Monthly
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.
Stack exhaustion in Apache Thrift before 0.25.0 allows remote, unauthenticated attackers to crash processes that deserialize attacker-controlled Thrift messages, because the protocol skip routine in several language bindings fails to apply the binding's recursion limit when skipping unknown fields. The affected bindings are the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bug is reachable over the network with no privileges or user interaction, but the impact metrics (VC:N/VI:N/VA:H) restrict the consequence to availability loss. There is no code execution or data exposure, no public exploit code and no confirmed active exploitation at time of analysis, and Apache has released version 0.25.0 which restores the recursion limit.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send Thrift protocol messages to a parsing service trigger an integer-overflow-driven undersized heap allocation followed by an out-of-bounds write, resulting in a crash (denial of service) or potentially attacker-controlled memory corruption with high confidentiality, integrity, and availability impact. The affected surface is any service that deserializes untrusted Thrift traffic; the CVSS v4.0 score of 9.2 reflects network reachability and no required privileges or user interaction, while the AC:H and AT:P metrics (mirrored by the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate that a successful exploit depends on crafting malformed messages that reliably hit the overflow condition and on runtime factors such as heap layout, memory limits, and the specific protocol/transport in use. No public exploit code or confirmed active exploitation was identified at time of analysis, but the framework's broad embedding in RPC and serialization pipelines makes prompt upgrade to 0.25.0 the clear priority. Services that never parse Thrift input from untrusted or remote peers are not reachable through this vector.
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to crash an entire Thrift-serving process by sending a single crafted frame over the TFramedTransport or THeaderTransport. A frame that yields no payload bytes causes the transport to recurse into Read rather than loop, so a peer can drive unbounded recursion with only 4 bytes (declared frame size of zero) or 18 bytes (a header block that fills the frame) until the Go stack limit is hit; the resulting runtime fatal error is not catchable by recover() and kills the process. The impact is availability-only - no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, though exploitation needs only network reachability to the Thrift listener with no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/.../VA:H).
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings, affecting all versions before 0.25.0, where a crafted or malformed Thrift message can drive the decoder into an infinite loop with an unreachable exit condition (CWE-835). The issue is remotely reachable and requires no authentication per the published CVSS 4.0 vector (PR:N), though the AT:P attack-requirements flag and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicate a specific input condition must be satisfied rather than arbitrary traffic. Impact is confined to availability - a hung thread, pinned CPU, or resource exhaustion that can stall or crash the service - with no data exposure, modification, or code execution; only applications that compile and use the c_glib bindings are affected, and no public exploit code has been identified at time of analysis. Upgrading to 0.25.0 removes the condition.
Denial of service in the PHP bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust process stack space and crash the parsing worker by supplying deeply nested or self-referential serialized Thrift messages. The flaw is an uncontrolled recursion (CWE-674) in the deserialization path, rated 8.2 High under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and 8.2-equivalent High under the assessed CVSS 3.1 vector (A:H only), confirming that impact is confined to availability. Exploitation is not unconditional: the CVSS 4.0 AT:P attack-requirement flag reflects that the target service must actually accept and deserialize attacker-controllable Thrift payloads through the PHP bindings, so internal services processing only trusted, bounded data are not realistically exposed. There is no public exploit code and no confirmed active exploitation at time of analysis, and a vendor-released fix is available in Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Perl bindings affects all releases before 0.25.0, allowing unauthenticated remote attackers to exhaust CPU or memory resources on services that deserialize attacker-controlled Thrift messages through the Perl language runtime. Only deployments using the Perl bindings are exposed; services built on the Java, Python, C++, or Go bindings are not affected by this specific flaw, and no public exploit code was identified at time of analysis, nor is there any CISA KEV confirmation of active exploitation. Impact is availability-only (no confidentiality or integrity loss), the vendor-released fix is Apache Thrift 0.25.0, and exploitation depends on the malicious input actually reaching the vulnerable parsing routine (the CVSS 4.0 AT:P / assessed AC:H condition).
Services that parse attacker-supplied input through Apache Thrift's Perl bindings before version 0.25.0 can be driven into an uncaught exception, crashing the hosting process or thread and causing a denial of service. The flaw is network-reachable and requires no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N, score 8.2), but its impact is confined to availability (VA:H) with no confidentiality or integrity effect, and the CVSS 4.0 AT:P metric indicates a specific precondition - the attacker's input must actually reach the vulnerable Perl deserialization/handler path. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is resolved by the vendor's 0.25.0 release.
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reachable Thrift RPC services running any version before 0.25.0. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or special configuration are required: any reachable Thrift Ruby service that parses attacker-supplied protocol messages can be knocked offline, though impact is limited to availability with no confidentiality or integrity loss. The flaw carries a CVSS 4.0 score of 8.7 (High) and an assessed CVSS 3.1 of 7.5, and no public exploit identified at time of analysis; exposure is confined to deployments using the Ruby language bindings rather than Thrift bindings for other languages.
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unauthenticated attackers to exhaust CPU and cause denial of service by supplying crafted input that the Lua binding parses. Only deployments that specifically use the Thrift Lua language binding and expose it to attacker-influenced data are affected; applications using other Thrift language bindings (Java, Python, C++, Go, etc.) are not impacted. The impact is limited to availability - no confidentiality or integrity loss is indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Apache Thrift's JavaME bindings (versions before 0.25.0) allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol input, causing service outages. The flaw is CWE-770 (uncontrolled resource allocation) and is limited to availability impact; there is no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and upgrading to 0.25.0 resolves the issue.
Unbounded resource allocation in the Ruby bindings of Apache Thrift (versions before 0.25.0) lets unauthenticated remote clients exhaust server memory or CPU by sending Thrift messages whose declared structure or container sizes trigger excessive allocation while the service deserializes them. Only network-reachable services that actually accept and parse untrusted Thrift payloads through the Ruby bindings are exposed, and the impact is confined to availability, with no data disclosure or modification (C:N/I:N/A:H). The Apache Software Foundation has released 0.25.0 as the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor rates this 8.2 (High) under CVSS 4.0, while our independent assessment also treats it as High severity but notes a higher attack complexity (AC:H in v3.1 terms) because the attacker must reach a service that parses untrusted Thrift messages.
Denial of service in the Lua language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift messages that trigger uncontrolled allocation or inefficient algorithmic paths. The issue is limited to deployments that actively use the Lua bindings; other language bindings are unaffected. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and the impact is confined to availability-no data disclosure or code execution.
Denial of service in Apache Thrift Python bindings before 0.25.0 allows unauthenticated remote attackers to hang the service by sending crafted Thrift messages that drive the parser into an infinite loop (CWE-835). Exploitation is network-based but requires a specific condition, such as a particular protocol/transport or malformed message structure, to trigger the loop (AT:P / AC:H). The impact is limited to availability-no data disclosure or code execution-and only services exposing a Thrift endpoint that processes untrusted input using the Python bindings are affected; no public exploit code has been identified at time of analysis.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol messages that trigger inefficient algorithmic complexity (CWE-407). The vulnerability affects only applications that use the PHP bindings to deserialize untrusted Thrift input; other language bindings are unaffected. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 AT:P metric indicates a specific attack precondition must be met, so exploitation is not guaranteed against every deployment.
Denial of service in the Dart language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server memory and CPU by sending crafted Thrift messages to a network-reachable Dart-based service that deserializes untrusted input (CWE-770, allocation of resources without limits or throttling). Impact is limited to availability (service slowdown or crash); there is no confidentiality or integrity consequence, and deployments using other Thrift language bindings such as C++, Java, Python or Go are not affected. No public exploit code was identified at time of analysis and the vendor-released fix that resolves the issue is Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Denial of service in Apache Thrift's Go bindings (versions before 0.25.0) lets unauthenticated remote attackers exhaust memory or CPU by sending highly compressed payloads over a compressed transport, so a tiny request expands into a disproportionately large in-memory buffer (CWE-409 data amplification / decompression bomb). Exploitation is conditional: per the vendor's CVSS 4.0 score the AT:P metric applies, meaning the affected service must actually accept attacker-supplied compressed data (for example a zlib-backed transport carrying untrusted input) - deployments of the Go bindings that do not parse compressed payloads from external sources are not exposed. Impact is availability-only (service crash, hang, or memory exhaustion) with no code execution or data disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment uses a 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflecting that precondition.
Denial of service in Apache Thrift's Python bindings before 0.25.0 arises from improper handling of highly compressed data (CWE-409), letting a remote, unauthenticated attacker send a small compressed Thrift payload that expands dramatically during parsing and exhausts server memory or CPU. Exploitation requires a service that accepts externally supplied Thrift data and decompresses or size-expands it, and the impact is confined to availability with no data disclosure or code execution. No public exploit code has been identified at time of analysis, and upgrading to 0.25.0 eliminates the vulnerability.
Denial of service in the D-language binding of Apache Thrift (thrift.server.nonblocking.TNonblockingServer) allows unauthenticated remote attackers to crash the server by sending a crafted or malformed message that provokes an uncaught exception and improper resource shutdown. Only deployments built with the D binding at versions before 0.25.0 and specifically using TNonblockingServer are affected, and the impact is limited to availability with no data exposure or modification. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 to fix the issue.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed input reaching the service endpoint triggers an uncaught exception, an infinite loop with an unreachable exit condition, and an integer underflow that can crash or hang the service. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), meaning unauthenticated remote attackers who can reach a D-bindings Thrift service need no credentials, user interaction, or non-default configuration to cause disruption. Exposure is narrow because only services compiled against the D bindings are affected - Java, Python, C++, Go and other language binding deployments are not - and no public exploit code has been identified at time of analysis.
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Integer underflow in Apache Thrift's C++ THeaderTransport can wrap a length or offset calculation and produce an out-of-bounds write, allowing a network attacker to crash or destabilize services that parse THeader-framed messages. The exposure is narrow: the library must be compiled as a 32-bit binary and must actually use THeaderTransport, while 64-bit builds and services relying on other transports are not affected, so the realistic outcome is denial of service rather than code execution or data disclosure. Affected releases are Apache Thrift before 0.25.0; no public exploit code has been identified at time of analysis, and the vendor's own scoring reflects availability-only impact (VA:H with no confidentiality or integrity effect).
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize attacker-controlled Thrift messages, and the flaw is present across the Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. The supplied CVSS 4.0 vector (8.7 High) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that impact is availability-only: no confidentiality or integrity loss, and no authentication, user interaction, or special configuration is required beyond a reachable endpoint that accepts untrusted Thrift input. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor-released fix is version 0.25.0.
Denial of service in Apache Thrift's Erlang bindings affects all releases before 0.25.0, where unauthenticated remote attackers who can reach a Thrift service that parses untrusted serialized input can send deeply nested or otherwise resource-heavy messages that the Erlang deserialization code processes without recursion-depth or allocation limits. The result is uncontrolled recursion and unbounded resource consumption (CWE-674), leading to service crash or hang - availability impact only, with no confidentiality or integrity loss confirmed. Exploitation requires the specific precondition that the target actually parses the attacker-supplied payload (CVSS 4.0 AT:P), and the flaw is confined to the Erlang bindings rather than all Thrift language bindings, so this is a moderate-priority availability issue rather than a top-tier emergency; no public exploit code has been identified at time of analysis, and the vendor-released fix is Apache Thrift 0.25.0.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Denial of service in Apache Thrift Node.js bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift listener to send a crafted or malformed message that triggers an uncaught exception and terminates the Node.js process. The vendor CVSS 4.0 score is 8.7 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity loss. Only the Node.js language bindings are affected; no public exploit identified at time of analysis.
Resource-exhaustion denial of service in Apache Thrift's Java TSaslNonblockingServer component allows remote attackers to drive the service into an unresponsive state by consuming server resources without limit (CWE-770). All Apache Thrift releases before 0.25.0 are affected, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the attack is network-reachable and requires no credentials or user interaction once an exposed TSaslNonblockingServer endpoint is reachable; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is only possible against deployments that specifically use the Java non-blocking SASL server class, which limits real-world exposure since blocking servers and non-SASL configurations are unaffected; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than an emergency.
Denial of service in the Erlang language bindings of Apache Thrift before 0.25.0 allows remote attackers to exhaust server resources through unbounded allocation, degrading or crashing the affected service. The flaw is CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v4.0 base score of 8.2; our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high-availability-only impact that requires a specific crafted message structure (AT:P) rather than arbitrary traffic. Only deployments running a Thrift server compiled with the Erlang bindings and exposed to attacker-reachable network traffic are affected; users of the C++, Java, Python, Go and other bindings are not impacted, and no public exploit code was identified at time of analysis.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Denial of service in the Apache Thrift PHP bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift service built on those bindings to exhaust server resources via unbounded allocation. The flaw is CWE-770 (allocation of resources without limits or throttling), triggered when the PHP binding processes attacker-controllable message sizes or collections without a cap; impact is limited to availability (VA:H; VC:N/VI:N), meaning no data disclosure or code execution. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so risk is highest for externally reachable Thrift endpoints that accept untrusted clients. Vendor-released patch: 0.25.0.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Uncontrolled recursion in Apache Thrift's c_glib (C/GLib) bindings causes stack exhaustion and process crash when a crafted, deeply nested message is deserialized from an untrusted source. Only applications built against the c_glib bindings at versions before 0.25.0 are affected; deployments using the Java, Python, C++ or other language bindings are not impacted by this specific issue. The flaw is availability-only - no confidentiality or integrity loss - and is reachable over the network without authentication (CVSS:4.0 PR:N, AT:P), though exploitation depends on the recursive parsing path being exposed to attacker-controlled input; no public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated, attacker-triggered exceptional conditions in the Apache Thrift Java bindings can leak server-side resources and degrade or exhaust a Thrift RPC service running any version before 0.25.0. The issue is remotely reachable without authentication (CVSS PR:N) and needs no user interaction, but the assessed impact is availability only - there is no confirmed confidentiality or integrity effect, so this is a denial-of-service exposure rather than a data-compromise issue. A CVSS 4.0 attack-requirement flag (AT:P) indicates a specific precondition must be met to drive the vulnerable error path, meaning not every request triggers the leak; the precise condition is not specified in the public advisory text, and no public exploit identified at time of analysis. Deployments not using the Java bindings, or already on 0.25.0 or later, are unaffected.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
Heap-based buffer overflow in the C++ THeaderTransport of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker corrupt heap memory when an application enables the non-default ZLIB transform for outgoing frames and poorly compressible, peer-influenced data expands during compression. The copy into the write buffer happens without a bounds check, so oversized input overflows the heap allocation and, for large frames, also reads past the end of the transform buffer; impact scales with frame size and reliable code execution versus a crash depends on heap layout. No public exploit code has been identified at time of analysis, and because exploitation requires the ZLIB write transform precondition (without it the vulnerable copy path is never reached), this is a credible high-priority issue rather than an automatic emergency.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a crafted frame header to a network-reachable Thrift endpoint, causing a stack-based buffer overflow that crashes the service; the flaw combines CWE-121 with an incorrect bitwise shift of an integer in the same header-parsing code path. Every Apache Thrift release before 0.25.0 ships the vulnerable C++ implementation, although only services that actually use the THeaderProtocol transport are exposed - services built against other Thrift protocols or transports are not affected by this specific code path. The CVSS 4.0 base score is 8.7 on a fully unauthenticated, network-reachable vector with availability-only impact (VC:N/VI:N/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Memory exhaustion in Apache Thrift's THeaderTransport affects all versions before 0.25.0, allowing remote attackers to cause a denial of service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction: an attacker can send crafted messages to a Thrift endpoint that uses THeaderTransport, triggering unreleased memory allocations that accumulate and eventually exhaust server resources. The flaw is rated CVSS 8.7 (4.0) with availability-only impact (VC:N/VI:N/VA:H); no public exploit code has been identified at the time of analysis.
Denial of service in Apache Thrift's Dart bindings (all versions before 0.25.0) lets an unauthenticated remote attacker crash or hang a service by sending a Thrift message whose length or size field declares an excessive allocation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, score 8.7) confirms the flaw is remotely reachable without authentication or user interaction, but impact is confined to availability - confidentiality and integrity are explicitly rated N, with no data exposure or code execution described in any source. Only deployments that deserialize attacker-supplied Thrift traffic through the Dart bindings are affected, and no public exploit identified at time of analysis.
Denial of service in the Apache Thrift Java bindings before 0.25.0 allows remote, unauthenticated attackers to crash or exhaust resources on a service that deserializes attacker-controlled Thrift messages, because exceptional conditions on the message-handling path are not handled correctly and resource allocation is not bounded or throttled. Only deployments running affected Thrift Java server code on a network-reachable endpoint are at risk; impact is confined to availability (service crash / resource exhaustion) with no loss of confidentiality or integrity, and a specific precondition must hold - the crafted input must reach the vulnerable exception-handling or allocation path rather than any arbitrary request. There is no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 0.25.0.
Denial of service in Apache Thrift's Lua language bindings (all versions before 0.25.0) allows unauthenticated remote attackers to drive unbounded resource allocation by sending protocol messages whose declared length parameter is inconsistent with the actual data, abusing a missing allocation limit (CWE-770). Per the vendor vector (PR:N/UI:N) no credentials or user interaction are required; impact is confined to availability (AV:N/AC:L/PR:N/UI:N with A:H, and no confidentiality or integrity effect), meaning memory or CPU exhaustion and likely process termination rather than data exposure or modification. Only deployments that expose a Thrift service implemented with the Lua bindings are in scope, so services built on Thrift's C++, Java, Python, Go and other bindings are not affected by this specific issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and no EPSS score was supplied for this analysis.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust resources through the Delphi bindings' buffered transport (TBufferedTransport), causing service unavailability. The flaw is an unbounded resource allocation issue (CWE-770) scored 6.9 (CVSS 4.0) with availability-only impact; exploitation requires a reachable service built with the Delphi bindings and buffered transport. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 as the fix.
A missing release of memory (CWE-401) in Apache Thrift C++ bindings before 0.25.0 allows remote, unauthenticated attackers to cause gradual memory exhaustion and a low-impact denial of service by repeatedly exercising the vulnerable code path. Exploitation requires a service that uses the affected C++ bindings, is network-reachable, and processes enough requests to accumulate the leak to a service-affecting level; non-C++ bindings are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and the impact is confined to availability with no data exposure or code execution.
Denial of service in Apache Thrift's PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources via unbounded allocation during deserialization of incoming data (CWE-770). The vulnerability requires a non-default or situational precondition (AT:P per CVSS 4.0) and impacts only availability, with no data compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor advises upgrading to 0.25.0.
Uninitialized-resource handling in the Apache Thrift C++ WebSocket server causes the server to return incorrect status codes and potentially leak stale memory contents in responses. All Apache Thrift releases before 0.25.0 are affected, but only deployments that actually run the C++ WebSocket server transport are exposed - the default binary and framed socket transports are not in scope. Exploitation is remote and requires no authentication or user interaction, but an attack-requirement precondition (AT:P in the vendor CVSS 4.0 vector, a specific server state or timing condition) makes it unreliably repeatable, and impact is limited to low integrity effects with no confirmed confidentiality or availability loss; no public exploit identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one, and the vendor-released fix is Apache Thrift 0.25.0.
Prototype pollution in the JavaScript bindings of Apache Thrift (all versions before 0.25.0) allows unauthenticated remote attackers to corrupt object prototype attributes when an application deserializes attacker-influenced Thrift messages through generated JS code. Impact is integrity-only and limited - the vendor-assigned CVSS 4.0 base score is 6.3, while our independent CVSS 3.1 assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting that exploitation requires the JS binding to be in the data path and specific object properties to be reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Apache has released a fix in version 0.25.0, which also requires regenerating JS code to be effective.
TLS hostname verification in the Apache Thrift C++ and D libraries can be bypassed, letting a man-in-the-middle present a certificate that chains to an already-trusted CA and still be accepted for the wrong hostname. The default access managers shipped with the C++ TSSLSocketFactory (versions 0.7.0 through 0.24.0) and the D accessManager property (versions 0.9.0 through 0.24.0) treat a non-matching subjectAltName dNSName as a 'skip' instead of a rejection and then fall back to the certificate Common Name, which violates RFC 6125 section 6.4.4 and RFC 9525 section 2. Because public CAs have not issued on Common Name alone for years, the practical exposure is confined to private or enterprise PKI deployments where such certificates still exist, and exploitation additionally requires an on-path attacker plus a CN-matching certificate from a trusted CA; unauthenticated per the CVSS 4.0 vector (PR:N) and no public exploit identified at time of analysis.
Improper TLS certificate validation in the Apache Thrift Python bindings (all versions before 0.25.0) allows a man-in-the-middle attacker to present a forged or otherwise invalid certificate and have it accepted, breaking the confidentiality and integrity guarantees of Thrift RPC traffic. Because the flaw also returns an incorrect status code on the failed validation path, code that inspects the returned status may mistakenly treat a rejected or malicious connection as legitimate. Exploitation is conditional rather than opportunistic: the attacker must already occupy a man-in-the-middle position on the network path (AT:P, AC:H) and the victim deployment must actually rely on Thrift's Python TLS transport for trust; authentication is not required (PR:N) and no user interaction is needed (UI:N). No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the independent assessment rates this as a moderate, conditional risk rather than an urgent priority.
Improper certificate validation in the Perl bindings of Apache Thrift before 0.25.0 leaves TLS peer verification effectively disabled by default, allowing an active man-in-the-middle to impersonate the RPC server, read and alter traffic, and return forged responses. The flaw is unauthenticated (PR:N) and needs no user interaction, but exploitation is conditional on the deployment actually using the Perl bindings for TLS-protected RPC and on the attacker holding a network interception vantage point (vendor CVSS 4.0 AT:P; independent CVSS 3.1 AC:H), which limits real-world exposure to a moderate, conditional TLS trust issue rather than a broadly exploitable one. Upgrading to 0.25.0 remediates the flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Uninitialized-resource handling in Apache Thrift's c_glib (C/GLib) bindings before 0.25.0 allows unauthenticated, network-reachable attackers to read stale memory contents or receive incorrect status codes from a service built with those bindings, producing limited information disclosure and low availability impact with no integrity impact. There is no public exploit identified at time of analysis, and independent assessment rates this moderate rather than urgent because exposure is narrow (only processes compiled against the c_glib binding are implicated, not Java, Python, C++, Go, or other bindings) and the CVSS attack-requirement metric (AT:P in the CVSS 4.0 vector, AC:H in the assessed CVSS 3.1 vector) signals that a specific request/protocol condition must be met before the vulnerable path triggers.
Remote unauthenticated denial of service in Apache Thrift c_glib language bindings (versions before 0.23.0) allows attackers to crash Thrift servers via specially crafted requests triggering 'free(): invalid pointer' fatal errors. CVSS 7.5 (HIGH) with network vector and low complexity. EPSS score is only 0.02% (4th percentile), indicating very low real-world exploitation probability despite theoretical severity. No active exploitation confirmed (not in CISA KEV); no public POC identified at time of analysis. Vendor-released patch: Apache Thrift 0.23.0.
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.
Stack exhaustion in Apache Thrift before 0.25.0 allows remote, unauthenticated attackers to crash processes that deserialize attacker-controlled Thrift messages, because the protocol skip routine in several language bindings fails to apply the binding's recursion limit when skipping unknown fields. The affected bindings are the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bug is reachable over the network with no privileges or user interaction, but the impact metrics (VC:N/VI:N/VA:H) restrict the consequence to availability loss. There is no code execution or data exposure, no public exploit code and no confirmed active exploitation at time of analysis, and Apache has released version 0.25.0 which restores the recursion limit.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send Thrift protocol messages to a parsing service trigger an integer-overflow-driven undersized heap allocation followed by an out-of-bounds write, resulting in a crash (denial of service) or potentially attacker-controlled memory corruption with high confidentiality, integrity, and availability impact. The affected surface is any service that deserializes untrusted Thrift traffic; the CVSS v4.0 score of 9.2 reflects network reachability and no required privileges or user interaction, while the AC:H and AT:P metrics (mirrored by the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate that a successful exploit depends on crafting malformed messages that reliably hit the overflow condition and on runtime factors such as heap layout, memory limits, and the specific protocol/transport in use. No public exploit code or confirmed active exploitation was identified at time of analysis, but the framework's broad embedding in RPC and serialization pipelines makes prompt upgrade to 0.25.0 the clear priority. Services that never parse Thrift input from untrusted or remote peers are not reachable through this vector.
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to crash an entire Thrift-serving process by sending a single crafted frame over the TFramedTransport or THeaderTransport. A frame that yields no payload bytes causes the transport to recurse into Read rather than loop, so a peer can drive unbounded recursion with only 4 bytes (declared frame size of zero) or 18 bytes (a header block that fills the frame) until the Go stack limit is hit; the resulting runtime fatal error is not catchable by recover() and kills the process. The impact is availability-only - no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, though exploitation needs only network reachability to the Thrift listener with no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/.../VA:H).
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings, affecting all versions before 0.25.0, where a crafted or malformed Thrift message can drive the decoder into an infinite loop with an unreachable exit condition (CWE-835). The issue is remotely reachable and requires no authentication per the published CVSS 4.0 vector (PR:N), though the AT:P attack-requirements flag and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicate a specific input condition must be satisfied rather than arbitrary traffic. Impact is confined to availability - a hung thread, pinned CPU, or resource exhaustion that can stall or crash the service - with no data exposure, modification, or code execution; only applications that compile and use the c_glib bindings are affected, and no public exploit code has been identified at time of analysis. Upgrading to 0.25.0 removes the condition.
Denial of service in the PHP bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust process stack space and crash the parsing worker by supplying deeply nested or self-referential serialized Thrift messages. The flaw is an uncontrolled recursion (CWE-674) in the deserialization path, rated 8.2 High under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and 8.2-equivalent High under the assessed CVSS 3.1 vector (A:H only), confirming that impact is confined to availability. Exploitation is not unconditional: the CVSS 4.0 AT:P attack-requirement flag reflects that the target service must actually accept and deserialize attacker-controllable Thrift payloads through the PHP bindings, so internal services processing only trusted, bounded data are not realistically exposed. There is no public exploit code and no confirmed active exploitation at time of analysis, and a vendor-released fix is available in Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Perl bindings affects all releases before 0.25.0, allowing unauthenticated remote attackers to exhaust CPU or memory resources on services that deserialize attacker-controlled Thrift messages through the Perl language runtime. Only deployments using the Perl bindings are exposed; services built on the Java, Python, C++, or Go bindings are not affected by this specific flaw, and no public exploit code was identified at time of analysis, nor is there any CISA KEV confirmation of active exploitation. Impact is availability-only (no confidentiality or integrity loss), the vendor-released fix is Apache Thrift 0.25.0, and exploitation depends on the malicious input actually reaching the vulnerable parsing routine (the CVSS 4.0 AT:P / assessed AC:H condition).
Services that parse attacker-supplied input through Apache Thrift's Perl bindings before version 0.25.0 can be driven into an uncaught exception, crashing the hosting process or thread and causing a denial of service. The flaw is network-reachable and requires no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N, score 8.2), but its impact is confined to availability (VA:H) with no confidentiality or integrity effect, and the CVSS 4.0 AT:P metric indicates a specific precondition - the attacker's input must actually reach the vulnerable Perl deserialization/handler path. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is resolved by the vendor's 0.25.0 release.
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reachable Thrift RPC services running any version before 0.25.0. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or special configuration are required: any reachable Thrift Ruby service that parses attacker-supplied protocol messages can be knocked offline, though impact is limited to availability with no confidentiality or integrity loss. The flaw carries a CVSS 4.0 score of 8.7 (High) and an assessed CVSS 3.1 of 7.5, and no public exploit identified at time of analysis; exposure is confined to deployments using the Ruby language bindings rather than Thrift bindings for other languages.
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unauthenticated attackers to exhaust CPU and cause denial of service by supplying crafted input that the Lua binding parses. Only deployments that specifically use the Thrift Lua language binding and expose it to attacker-influenced data are affected; applications using other Thrift language bindings (Java, Python, C++, Go, etc.) are not impacted. The impact is limited to availability - no confidentiality or integrity loss is indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Apache Thrift's JavaME bindings (versions before 0.25.0) allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol input, causing service outages. The flaw is CWE-770 (uncontrolled resource allocation) and is limited to availability impact; there is no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and upgrading to 0.25.0 resolves the issue.
Unbounded resource allocation in the Ruby bindings of Apache Thrift (versions before 0.25.0) lets unauthenticated remote clients exhaust server memory or CPU by sending Thrift messages whose declared structure or container sizes trigger excessive allocation while the service deserializes them. Only network-reachable services that actually accept and parse untrusted Thrift payloads through the Ruby bindings are exposed, and the impact is confined to availability, with no data disclosure or modification (C:N/I:N/A:H). The Apache Software Foundation has released 0.25.0 as the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor rates this 8.2 (High) under CVSS 4.0, while our independent assessment also treats it as High severity but notes a higher attack complexity (AC:H in v3.1 terms) because the attacker must reach a service that parses untrusted Thrift messages.
Denial of service in the Lua language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift messages that trigger uncontrolled allocation or inefficient algorithmic paths. The issue is limited to deployments that actively use the Lua bindings; other language bindings are unaffected. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and the impact is confined to availability-no data disclosure or code execution.
Denial of service in Apache Thrift Python bindings before 0.25.0 allows unauthenticated remote attackers to hang the service by sending crafted Thrift messages that drive the parser into an infinite loop (CWE-835). Exploitation is network-based but requires a specific condition, such as a particular protocol/transport or malformed message structure, to trigger the loop (AT:P / AC:H). The impact is limited to availability-no data disclosure or code execution-and only services exposing a Thrift endpoint that processes untrusted input using the Python bindings are affected; no public exploit code has been identified at time of analysis.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol messages that trigger inefficient algorithmic complexity (CWE-407). The vulnerability affects only applications that use the PHP bindings to deserialize untrusted Thrift input; other language bindings are unaffected. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 AT:P metric indicates a specific attack precondition must be met, so exploitation is not guaranteed against every deployment.
Denial of service in the Dart language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server memory and CPU by sending crafted Thrift messages to a network-reachable Dart-based service that deserializes untrusted input (CWE-770, allocation of resources without limits or throttling). Impact is limited to availability (service slowdown or crash); there is no confidentiality or integrity consequence, and deployments using other Thrift language bindings such as C++, Java, Python or Go are not affected. No public exploit code was identified at time of analysis and the vendor-released fix that resolves the issue is Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Denial of service in Apache Thrift's Go bindings (versions before 0.25.0) lets unauthenticated remote attackers exhaust memory or CPU by sending highly compressed payloads over a compressed transport, so a tiny request expands into a disproportionately large in-memory buffer (CWE-409 data amplification / decompression bomb). Exploitation is conditional: per the vendor's CVSS 4.0 score the AT:P metric applies, meaning the affected service must actually accept attacker-supplied compressed data (for example a zlib-backed transport carrying untrusted input) - deployments of the Go bindings that do not parse compressed payloads from external sources are not exposed. Impact is availability-only (service crash, hang, or memory exhaustion) with no code execution or data disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment uses a 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflecting that precondition.
Denial of service in Apache Thrift's Python bindings before 0.25.0 arises from improper handling of highly compressed data (CWE-409), letting a remote, unauthenticated attacker send a small compressed Thrift payload that expands dramatically during parsing and exhausts server memory or CPU. Exploitation requires a service that accepts externally supplied Thrift data and decompresses or size-expands it, and the impact is confined to availability with no data disclosure or code execution. No public exploit code has been identified at time of analysis, and upgrading to 0.25.0 eliminates the vulnerability.
Denial of service in the D-language binding of Apache Thrift (thrift.server.nonblocking.TNonblockingServer) allows unauthenticated remote attackers to crash the server by sending a crafted or malformed message that provokes an uncaught exception and improper resource shutdown. Only deployments built with the D binding at versions before 0.25.0 and specifically using TNonblockingServer are affected, and the impact is limited to availability with no data exposure or modification. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 to fix the issue.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed input reaching the service endpoint triggers an uncaught exception, an infinite loop with an unreachable exit condition, and an integer underflow that can crash or hang the service. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), meaning unauthenticated remote attackers who can reach a D-bindings Thrift service need no credentials, user interaction, or non-default configuration to cause disruption. Exposure is narrow because only services compiled against the D bindings are affected - Java, Python, C++, Go and other language binding deployments are not - and no public exploit code has been identified at time of analysis.
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Integer underflow in Apache Thrift's C++ THeaderTransport can wrap a length or offset calculation and produce an out-of-bounds write, allowing a network attacker to crash or destabilize services that parse THeader-framed messages. The exposure is narrow: the library must be compiled as a 32-bit binary and must actually use THeaderTransport, while 64-bit builds and services relying on other transports are not affected, so the realistic outcome is denial of service rather than code execution or data disclosure. Affected releases are Apache Thrift before 0.25.0; no public exploit code has been identified at time of analysis, and the vendor's own scoring reflects availability-only impact (VA:H with no confidentiality or integrity effect).
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize attacker-controlled Thrift messages, and the flaw is present across the Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. The supplied CVSS 4.0 vector (8.7 High) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that impact is availability-only: no confidentiality or integrity loss, and no authentication, user interaction, or special configuration is required beyond a reachable endpoint that accepts untrusted Thrift input. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor-released fix is version 0.25.0.
Denial of service in Apache Thrift's Erlang bindings affects all releases before 0.25.0, where unauthenticated remote attackers who can reach a Thrift service that parses untrusted serialized input can send deeply nested or otherwise resource-heavy messages that the Erlang deserialization code processes without recursion-depth or allocation limits. The result is uncontrolled recursion and unbounded resource consumption (CWE-674), leading to service crash or hang - availability impact only, with no confidentiality or integrity loss confirmed. Exploitation requires the specific precondition that the target actually parses the attacker-supplied payload (CVSS 4.0 AT:P), and the flaw is confined to the Erlang bindings rather than all Thrift language bindings, so this is a moderate-priority availability issue rather than a top-tier emergency; no public exploit code has been identified at time of analysis, and the vendor-released fix is Apache Thrift 0.25.0.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Denial of service in Apache Thrift Node.js bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift listener to send a crafted or malformed message that triggers an uncaught exception and terminates the Node.js process. The vendor CVSS 4.0 score is 8.7 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity loss. Only the Node.js language bindings are affected; no public exploit identified at time of analysis.
Resource-exhaustion denial of service in Apache Thrift's Java TSaslNonblockingServer component allows remote attackers to drive the service into an unresponsive state by consuming server resources without limit (CWE-770). All Apache Thrift releases before 0.25.0 are affected, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the attack is network-reachable and requires no credentials or user interaction once an exposed TSaslNonblockingServer endpoint is reachable; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is only possible against deployments that specifically use the Java non-blocking SASL server class, which limits real-world exposure since blocking servers and non-SASL configurations are unaffected; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than an emergency.
Denial of service in the Erlang language bindings of Apache Thrift before 0.25.0 allows remote attackers to exhaust server resources through unbounded allocation, degrading or crashing the affected service. The flaw is CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v4.0 base score of 8.2; our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high-availability-only impact that requires a specific crafted message structure (AT:P) rather than arbitrary traffic. Only deployments running a Thrift server compiled with the Erlang bindings and exposed to attacker-reachable network traffic are affected; users of the C++, Java, Python, Go and other bindings are not impacted, and no public exploit code was identified at time of analysis.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Denial of service in the Apache Thrift PHP bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift service built on those bindings to exhaust server resources via unbounded allocation. The flaw is CWE-770 (allocation of resources without limits or throttling), triggered when the PHP binding processes attacker-controllable message sizes or collections without a cap; impact is limited to availability (VA:H; VC:N/VI:N), meaning no data disclosure or code execution. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so risk is highest for externally reachable Thrift endpoints that accept untrusted clients. Vendor-released patch: 0.25.0.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Uncontrolled recursion in Apache Thrift's c_glib (C/GLib) bindings causes stack exhaustion and process crash when a crafted, deeply nested message is deserialized from an untrusted source. Only applications built against the c_glib bindings at versions before 0.25.0 are affected; deployments using the Java, Python, C++ or other language bindings are not impacted by this specific issue. The flaw is availability-only - no confidentiality or integrity loss - and is reachable over the network without authentication (CVSS:4.0 PR:N, AT:P), though exploitation depends on the recursive parsing path being exposed to attacker-controlled input; no public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated, attacker-triggered exceptional conditions in the Apache Thrift Java bindings can leak server-side resources and degrade or exhaust a Thrift RPC service running any version before 0.25.0. The issue is remotely reachable without authentication (CVSS PR:N) and needs no user interaction, but the assessed impact is availability only - there is no confirmed confidentiality or integrity effect, so this is a denial-of-service exposure rather than a data-compromise issue. A CVSS 4.0 attack-requirement flag (AT:P) indicates a specific precondition must be met to drive the vulnerable error path, meaning not every request triggers the leak; the precise condition is not specified in the public advisory text, and no public exploit identified at time of analysis. Deployments not using the Java bindings, or already on 0.25.0 or later, are unaffected.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. It is availability-only: no code execution, data disclosure, or data tampering is known from this issue. No public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to 0.25.0 resolves it.
Heap-based buffer overflow in the C++ THeaderTransport of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker corrupt heap memory when an application enables the non-default ZLIB transform for outgoing frames and poorly compressible, peer-influenced data expands during compression. The copy into the write buffer happens without a bounds check, so oversized input overflows the heap allocation and, for large frames, also reads past the end of the transform buffer; impact scales with frame size and reliable code execution versus a crash depends on heap layout. No public exploit code has been identified at time of analysis, and because exploitation requires the ZLIB write transform precondition (without it the vulnerable copy path is never reached), this is a credible high-priority issue rather than an automatic emergency.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 lets remote, unauthenticated attackers exhaust CPU and memory on a Thrift-serving PHP application by sending a crafted Thrift message whose declared quantity is never validated. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor CVSS 4.0 base 8.7), the weakness is availability-only: there is no code execution, data exposure, or integrity impact, and only deployments that use the PHP bindings to parse untrusted Thrift input over the network are exposed. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and no EPSS score was supplied; non-PHP Thrift bindings are out of scope for this issue.
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a crafted frame header to a network-reachable Thrift endpoint, causing a stack-based buffer overflow that crashes the service; the flaw combines CWE-121 with an incorrect bitwise shift of an integer in the same header-parsing code path. Every Apache Thrift release before 0.25.0 ships the vulnerable C++ implementation, although only services that actually use the THeaderProtocol transport are exposed - services built against other Thrift protocols or transports are not affected by this specific code path. The CVSS 4.0 base score is 8.7 on a fully unauthenticated, network-reachable vector with availability-only impact (VC:N/VI:N/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Memory exhaustion in Apache Thrift's THeaderTransport affects all versions before 0.25.0, allowing remote attackers to cause a denial of service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction: an attacker can send crafted messages to a Thrift endpoint that uses THeaderTransport, triggering unreleased memory allocations that accumulate and eventually exhaust server resources. The flaw is rated CVSS 8.7 (4.0) with availability-only impact (VC:N/VI:N/VA:H); no public exploit code has been identified at the time of analysis.
Denial of service in Apache Thrift's Dart bindings (all versions before 0.25.0) lets an unauthenticated remote attacker crash or hang a service by sending a Thrift message whose length or size field declares an excessive allocation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, score 8.7) confirms the flaw is remotely reachable without authentication or user interaction, but impact is confined to availability - confidentiality and integrity are explicitly rated N, with no data exposure or code execution described in any source. Only deployments that deserialize attacker-supplied Thrift traffic through the Dart bindings are affected, and no public exploit identified at time of analysis.
Denial of service in the Apache Thrift Java bindings before 0.25.0 allows remote, unauthenticated attackers to crash or exhaust resources on a service that deserializes attacker-controlled Thrift messages, because exceptional conditions on the message-handling path are not handled correctly and resource allocation is not bounded or throttled. Only deployments running affected Thrift Java server code on a network-reachable endpoint are at risk; impact is confined to availability (service crash / resource exhaustion) with no loss of confidentiality or integrity, and a specific precondition must hold - the crafted input must reach the vulnerable exception-handling or allocation path rather than any arbitrary request. There is no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 0.25.0.
Denial of service in Apache Thrift's Lua language bindings (all versions before 0.25.0) allows unauthenticated remote attackers to drive unbounded resource allocation by sending protocol messages whose declared length parameter is inconsistent with the actual data, abusing a missing allocation limit (CWE-770). Per the vendor vector (PR:N/UI:N) no credentials or user interaction are required; impact is confined to availability (AV:N/AC:L/PR:N/UI:N with A:H, and no confidentiality or integrity effect), meaning memory or CPU exhaustion and likely process termination rather than data exposure or modification. Only deployments that expose a Thrift service implemented with the Lua bindings are in scope, so services built on Thrift's C++, Java, Python, Go and other bindings are not affected by this specific issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and no EPSS score was supplied for this analysis.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust resources through the Delphi bindings' buffered transport (TBufferedTransport), causing service unavailability. The flaw is an unbounded resource allocation issue (CWE-770) scored 6.9 (CVSS 4.0) with availability-only impact; exploitation requires a reachable service built with the Delphi bindings and buffered transport. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 as the fix.
A missing release of memory (CWE-401) in Apache Thrift C++ bindings before 0.25.0 allows remote, unauthenticated attackers to cause gradual memory exhaustion and a low-impact denial of service by repeatedly exercising the vulnerable code path. Exploitation requires a service that uses the affected C++ bindings, is network-reachable, and processes enough requests to accumulate the leak to a service-affecting level; non-C++ bindings are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and the impact is confined to availability with no data exposure or code execution.
Denial of service in Apache Thrift's PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources via unbounded allocation during deserialization of incoming data (CWE-770). The vulnerability requires a non-default or situational precondition (AT:P per CVSS 4.0) and impacts only availability, with no data compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor advises upgrading to 0.25.0.
Uninitialized-resource handling in the Apache Thrift C++ WebSocket server causes the server to return incorrect status codes and potentially leak stale memory contents in responses. All Apache Thrift releases before 0.25.0 are affected, but only deployments that actually run the C++ WebSocket server transport are exposed - the default binary and framed socket transports are not in scope. Exploitation is remote and requires no authentication or user interaction, but an attack-requirement precondition (AT:P in the vendor CVSS 4.0 vector, a specific server state or timing condition) makes it unreliably repeatable, and impact is limited to low integrity effects with no confirmed confidentiality or availability loss; no public exploit identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one, and the vendor-released fix is Apache Thrift 0.25.0.
Prototype pollution in the JavaScript bindings of Apache Thrift (all versions before 0.25.0) allows unauthenticated remote attackers to corrupt object prototype attributes when an application deserializes attacker-influenced Thrift messages through generated JS code. Impact is integrity-only and limited - the vendor-assigned CVSS 4.0 base score is 6.3, while our independent CVSS 3.1 assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting that exploitation requires the JS binding to be in the data path and specific object properties to be reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Apache has released a fix in version 0.25.0, which also requires regenerating JS code to be effective.
TLS hostname verification in the Apache Thrift C++ and D libraries can be bypassed, letting a man-in-the-middle present a certificate that chains to an already-trusted CA and still be accepted for the wrong hostname. The default access managers shipped with the C++ TSSLSocketFactory (versions 0.7.0 through 0.24.0) and the D accessManager property (versions 0.9.0 through 0.24.0) treat a non-matching subjectAltName dNSName as a 'skip' instead of a rejection and then fall back to the certificate Common Name, which violates RFC 6125 section 6.4.4 and RFC 9525 section 2. Because public CAs have not issued on Common Name alone for years, the practical exposure is confined to private or enterprise PKI deployments where such certificates still exist, and exploitation additionally requires an on-path attacker plus a CN-matching certificate from a trusted CA; unauthenticated per the CVSS 4.0 vector (PR:N) and no public exploit identified at time of analysis.
Improper TLS certificate validation in the Apache Thrift Python bindings (all versions before 0.25.0) allows a man-in-the-middle attacker to present a forged or otherwise invalid certificate and have it accepted, breaking the confidentiality and integrity guarantees of Thrift RPC traffic. Because the flaw also returns an incorrect status code on the failed validation path, code that inspects the returned status may mistakenly treat a rejected or malicious connection as legitimate. Exploitation is conditional rather than opportunistic: the attacker must already occupy a man-in-the-middle position on the network path (AT:P, AC:H) and the victim deployment must actually rely on Thrift's Python TLS transport for trust; authentication is not required (PR:N) and no user interaction is needed (UI:N). No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the independent assessment rates this as a moderate, conditional risk rather than an urgent priority.
Improper certificate validation in the Perl bindings of Apache Thrift before 0.25.0 leaves TLS peer verification effectively disabled by default, allowing an active man-in-the-middle to impersonate the RPC server, read and alter traffic, and return forged responses. The flaw is unauthenticated (PR:N) and needs no user interaction, but exploitation is conditional on the deployment actually using the Perl bindings for TLS-protected RPC and on the attacker holding a network interception vantage point (vendor CVSS 4.0 AT:P; independent CVSS 3.1 AC:H), which limits real-world exposure to a moderate, conditional TLS trust issue rather than a broadly exploitable one. Upgrading to 0.25.0 remediates the flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Uninitialized-resource handling in Apache Thrift's c_glib (C/GLib) bindings before 0.25.0 allows unauthenticated, network-reachable attackers to read stale memory contents or receive incorrect status codes from a service built with those bindings, producing limited information disclosure and low availability impact with no integrity impact. There is no public exploit identified at time of analysis, and independent assessment rates this moderate rather than urgent because exposure is narrow (only processes compiled against the c_glib binding are implicated, not Java, Python, C++, Go, or other bindings) and the CVSS attack-requirement metric (AT:P in the CVSS 4.0 vector, AC:H in the assessed CVSS 3.1 vector) signals that a specific request/protocol condition must be met before the vulnerable path triggers.
Remote unauthenticated denial of service in Apache Thrift c_glib language bindings (versions before 0.23.0) allows attackers to crash Thrift servers via specially crafted requests triggering 'free(): invalid pointer' fatal errors. CVSS 7.5 (HIGH) with network vector and low complexity. EPSS score is only 0.02% (4th percentile), indicating very low real-world exploitation probability despite theoretical severity. No active exploitation confirmed (not in CISA KEV); no public POC identified at time of analysis. Vendor-released patch: Apache Thrift 0.23.0.