Is CVE-2026-43871 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43871 being exploited in the wild.

How severe is CVE-2026-43871?

High severity, with a CVSS score of 7.5, published 27 July 2026.

Which products and versions are affected?

Apache Thrift before 0.24.0; github.com/apache/thrift (Go) < 0.24.0, SEMVER:introduced=0,fixed=0.24.0; org.apache.thrift:libthrift (Maven) < 0.24.0, ECOSYSTEM:introduced=0,fixed=0.24.0; apache/thrift (Packagist) < 0.24.0; and 1 more.

Is there a fix for CVE-2026-43871?

Yes. github.com/apache/thrift (Go): upgrade to 0.24.0 or later; org.apache.thrift:libthrift (Maven): upgrade to 0.24.0 or later; thrift (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43871 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-43871?

Check whether you run Apache Thrift, github.com/apache/thrift (Go), org.apache.thrift:libthrift (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43871: Apache Thrift infinite loop in Python, Go, PHP and Java bindings

Q: Is there a fix for CVE-2026-43871?

Yes. github.com/apache/thrift (Go): upgrade to 0.24.0 or later; org.apache.thrift:libthrift (Maven): upgrade to 0.24.0 or later; thrift (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-43871 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-43871?

Check whether you run Apache Thrift, github.com/apache/thrift (Go), org.apache.thrift:libthrift (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43871 · Severity: high · CVSS 7.5 · Published 2026-07-27

Apache Thrift is a widely-used RPC framework that enables communication between services written in different programming languages. An infinite loop vulnerability in Thrift's language bindings (Python, Go, PHP, and Java) can cause applications to hang or become unresponsive when processing malformed or specially crafted network messages. This results in denial of service, making affected applications unavailable to legitimate users.

Technologies: Apache Thrift, github.com/apache/thrift (Go), org.apache.thrift:libthrift (Maven), thrift (PyPI). Vendors: Apache, Go, Maven, Packagist, PyPI.

Quick answers

Is CVE-2026-43871 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43871 being exploited in the wild.
How severe is CVE-2026-43871?: High severity, with a CVSS score of 7.5, published 27 July 2026.
Which products and versions are affected?: Apache Thrift before 0.24.0; github.com/apache/thrift (Go) < 0.24.0, SEMVER:introduced=0,fixed=0.24.0; org.apache.thrift:libthrift (Maven) < 0.24.0, ECOSYSTEM:introduced=0,fixed=0.24.0; apache/thrift (Packagist) < 0.24.0; and 1 more.
Is there a fix for CVE-2026-43871?: Yes. github.com/apache/thrift (Go): upgrade to 0.24.0 or later; org.apache.thrift:libthrift (Maven): upgrade to 0.24.0 or later; thrift (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43871 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-43871?: Check whether you run Apache Thrift, github.com/apache/thrift (Go), org.apache.thrift:libthrift (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/apache/thrift (Go): upgrade to 0.24.0 or later
```
go get github.com/apache/thrift@v0.24.0
```

org.apache.thrift:libthrift (Maven): upgrade to 0.24.0 or later

# set org.apache.thrift:libthrift to 0.24.0 in your pom.xml or build.gradle

thrift (PyPI): upgrade to 0.24.0 or later
```
pip install "thrift>=0.24.0"
```

Technical details

The vulnerability is a loop with unreachable exit condition (CWE-835) in the Thrift RPC framework's language bindings. When processing incoming network requests, code in the Python, Go, PHP, and Java bindings contains a loop that cannot properly exit under certain conditions, resulting in an infinite loop that consumes CPU and blocks the application. The issue is reachable over the network without authentication or user interaction. An attacker can send crafted Thrift protocol messages to trigger the infinite loop, causing the affected service to hang. The fix is available in version 0.24.0, and users are advised to upgrade immediately.

Affected products

Apache Thrift before 0.24.0

Identifiers

CVE-2026-43871
GHSA-8wv5-x4w7-5gww
PYSEC-2026-3926

Timeline

2026-07-27: disclosed
2026-07-27: patched: Fix available in version 0.24.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.