Executive brief
Apache Thrift is a widely-used RPC framework that enables communication between services written in different programming languages. An infinite loop vulnerability in Thrift's language bindings (Python, Go, PHP, and Java) can cause applications to hang or become unresponsive when processing malformed or specially crafted network messages. This results in denial of service, making affected applications unavailable to legitimate users.
Technical details
The vulnerability is a loop with unreachable exit condition (CWE-835) in the Thrift RPC framework's language bindings. When processing incoming network requests, code in the Python, Go, PHP, and Java bindings contains a loop that cannot properly exit under certain conditions, resulting in an infinite loop that consumes CPU and blocks the application. The issue is reachable over the network without authentication or user interaction. An attacker can send crafted Thrift protocol messages to trigger the infinite loop, causing the affected service to hang. The fix is available in version 0.24.0, and users are advised to upgrade immediately.
Affected products
- Apache Thrift before 0.24.0
Timeline
- 2026-07-27: disclosed
- 2026-07-27: patched: Fix available in version 0.24.0