CVE-2026-43868: Apache Thrift denial of service via excessive memory allocation

Executive brief

Apache Thrift, a framework for cross-language services development, is vulnerable to a memory allocation issue. An attacker can send a specially crafted request that forces the system to allocate an excessive amount of memory, potentially leading to a denial-of-service condition where the application becomes unresponsive. This impacts the availability of services relying on the Thrift library for communication.

Technical details

Apache Thrift before version 0.23.0 contains a Memory Allocation with Excessive Size Value vulnerability (CWE-789) and improper validation of input offsets (CWE-1285). The vulnerability occurs when the library allocates memory based on an untrusted size value provided in a network request without ensuring the size is within reasonable limits. A remote, unauthenticated attacker can exploit this by sending a malicious payload with a large size value, causing the application to exhaust available memory and crash or hang (Denial of Service). The issue is addressed in version 0.23.0.

Affected products

• Apache Thrift < 0.23.0

Timeline

• 2026-05-05: disclosed
• 2026-05-05: advisory
• 2026-05-08: other: GitHub reviewed the advisory

References

• https://api.github.com/users/bayandin
• https://github.com/bayandin
• https://api.github.com/users/bayandin/gists%7B/gist_id%7D
• https://api.github.com/users/bayandin/repos
• https://avatars.githubusercontent.com/u/864213?v=4
• https://api.github.com/users/bayandin/events%7B/privacy%7D