CVE-2026-121824: Line Armeria Thrift denial of service via excessive memory allocation

CVE-2026-121824 · Severity: info · Published 2026-11-06

Armeria is a framework for building microservices using protocols like Thrift. An attacker can send specially crafted Thrift messages that declare enormous data sizes without providing the actual data, causing the server to allocate massive amounts of memory and crash. This results in denial of service, disrupting applications and potentially affecting all users relying on the service.

Technologies: LINE Armeria. Vendors: LINE.

Quick answers

Is CVE-2026-121824 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-121824 being exploited in the wild.
How severe is CVE-2026-121824?
Informational severity, published 6 November 2026.
Which products and versions are affected?
LINE Armeria < 1.43.0; LINE Armeria Thrift < 1.43.0; LINE Armeria Thrift 0.13 <= 1.42.0; LINE Armeria Thrift 0.14 <= 1.42.0; and 11 more.
Is there a fix for CVE-2026-121824?
Yes: fixed in 1.43.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121824 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-121824?
Check whether you run LINE Armeria, LINE Armeria Thrift, LINE Armeria Thrift 0.13 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.43.0

Technical details

The Thrift protocol decoders in Armeria (TBinary and TCompact) allocate heap memory based on attacker-controlled string or binary length fields before validating that the message body actually contains the declared data. Attackers on the network can send a valid HTTP request containing a truncated Thrift message with a declared length of gigabytes while providing zero payload bytes, causing the decoder to attempt allocating buffers larger than configured limits and exhausting heap memory or triggering OutOfMemoryError, crashing the service. A fix is available in version 1.43.0.

Affected products

  • Line Armeria < 1.43.0
  • Line Armeria Thrift < 1.43.0
  • Line Armeria Thrift 0.13 <= 1.42.0
  • Line Armeria Thrift 0.14 <= 1.42.0
  • Line Armeria Thrift 0.15 <= 1.42.0
  • Line Armeria Thrift 0.16 <= 1.42.0
  • Line Armeria Thrift 0.17 <= 1.42.0
  • Line Armeria Thrift 0.18 <= 1.42.0
  • Line Armeria Thrift 0.19 <= 1.42.0
  • Line Armeria Thrift 0.20 <= 1.42.0
  • Line Armeria Thrift 0.21 <= 1.42.0
  • Line Armeria Thrift 0.22 <= 1.42.0
  • Line Armeria Thrift 0.23 <= 1.42.0
  • Line Armeria Thrift 0.24 <= 1.42.0
  • Line Armeria Thrift 0.9 <= 1.42.0

Timeline

  • 2026-11-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.