CVE-2026-55969: Apache Thrift integer overflow in TProtocol checkReadBytesAvailable

Executive brief

Apache Thrift, a framework used for cross-language software development and communication, is affected by a security flaw in several of its programming language bindings. An attacker could exploit this vulnerability to cause a denial-of-service condition, potentially crashing applications or services that rely on Thrift for data exchange. This impact could lead to service outages and operational disruptions for affected systems.

Technical details

An Integer Overflow or Wraparound vulnerability (CWE-190) exists in the TProtocol::checkReadBytesAvailable() function within Apache Thrift. The issue affects the C++, c_glib, Go, netstd, Delphi, and Haxe bindings. A remote, unauthenticated attacker can exploit this by sending specially crafted data that triggers the overflow, leading to a denial-of-service (VA:H) by crashing the affected process. The vulnerability is fixed in version 0.24.0.

Affected products

• Apache Software Foundation Thrift before 0.24.0
• Apache Software Foundation c_glib language bindings before 0.24.0
• Apache Software Foundation github.com/apache/thrift (Go) before 0.24.0
• Apache Software Foundation ApacheThrift (netstd) before 0.24.0
• Apache Software Foundation Delphi language bindings before 0.24.0
• Apache Software Foundation thrift (Haxe) before 0.24.0

Timeline

• 2026-07-24: disclosed: Initial disclosure on oss-security mailing list
• 2026-07-27: advisory: NVD publication date

References

• https://conan.io/center
• https://proxy.golang.org/
• https://www.nuget.org/
• https://lib.haxe.org/
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo
• http://www.openwall.com/lists/oss-security/2026/07/24/40