Executive brief
Apache Thrift is a framework used for cross-language communication between different software services. A vulnerability in its Node.js component allows a remote attacker to crash or slow down a server by sending specially crafted data. This could lead to a denial-of-service (DoS) condition, making the affected application unavailable to legitimate users.
Technical details
The Apache Thrift Node.js bindings contain a vulnerability classified as Inefficient Algorithmic Complexity (CWE-407) and Allocation of Resources Without Limits or Throttling (CWE-770). Specifically, the server-side receive transports are susceptible to a quadratic-time complexity issue when processing incoming data. A remote, unauthenticated attacker can exploit this by sending malicious payloads that consume excessive CPU or memory resources, leading to a denial-of-service (DoS). The issue is resolved in version 0.24.0.
Affected products
- Apache Software Foundation Apache Thrift < 0.24.0
Timeline
- 2026-07-24: advisory: Initial disclosure on oss-security mailing list
- 2026-07-27: disclosed: CVE published to NVD