Executive brief
Apache Thrift, a software framework used for cross-language service development, contains a vulnerability in its Java components that can lead to a denial of service. An attacker can exploit this by sending specially crafted requests that cause the system to allocate excessive resources without proper limits. This can result in the application becoming unresponsive or crashing, disrupting business operations and service availability.
Technical details
A vulnerability classified as CWE-770 (Allocation of Resources Without Limits or Throttling) exists in the Apache Thrift Java bindings (libthrift). The flaw allows for unbounded reads, which can be triggered by a remote attacker to exhaust system resources. The issue specifically affects the Java library versions 0.19.0 through 0.23.0. An attacker can exploit this over the network without authentication to cause a Denial of Service (DoS) condition. The vulnerability is addressed in Apache Thrift version 0.24.0.
Affected products
- Apache Software Foundation Apache Thrift 0.19.0 to 0.23.0
Timeline
- 2026-07-24: disclosed: Initial disclosure on oss-security mailing list
- 2026-07-27: advisory: NVD publication date
- 2026-07-27: patched: Version 0.24.0 released to address the issue