Junglewise Threat Intelligence

CVE-2026-43871: Apache Thrift infinite loop in Python, Go, PHP and Java bindings

CVE-2026-43871 · Severity: high · CVSS 7.5 · Published 2026-07-27

Executive brief

Apache Thrift is a widely-used RPC framework that enables communication between services written in different programming languages. An infinite loop vulnerability in Thrift's language bindings (Python, Go, PHP, and Java) can cause applications to hang or become unresponsive when processing malformed or specially crafted network messages. This results in denial of service, making affected applications unavailable to legitimate users.

Technical details

The vulnerability is a loop with unreachable exit condition (CWE-835) in the Thrift RPC framework's language bindings. When processing incoming network requests, code in the Python, Go, PHP, and Java bindings contains a loop that cannot properly exit under certain conditions, resulting in an infinite loop that consumes CPU and blocks the application. The issue is reachable over the network without authentication or user interaction. An attacker can send crafted Thrift protocol messages to trigger the infinite loop, causing the affected service to hang. The fix is available in version 0.24.0, and users are advised to upgrade immediately.

Affected products

  • Apache Thrift before 0.24.0

Timeline

  • 2026-07-27: disclosed
  • 2026-07-27: patched: Fix available in version 0.24.0

References

Related threats