Executive brief
Apache Thrift is a software framework used for cross-language services development, allowing different systems to communicate efficiently. A security flaw in its C++ components could allow an attacker to read more data than intended or cause the service to crash. This could lead to the exposure of sensitive information or a disruption of business operations that rely on Thrift-based communication.
Technical details
A buffer over-read vulnerability (CWE-126) exists in the Apache Thrift C++ bindings for versions prior to 0.24.0. The flaw allows an attacker to trigger an out-of-bounds memory read via the network without authentication. This can result in the leakage of sensitive memory contents or a denial-of-service condition if the application crashes. The issue is resolved in Apache Thrift version 0.24.0.
Affected products
- Apache Thrift before 0.24.0
Timeline
- 2026-07-27: advisory: NVD publication date
- 2026-07-27: disclosed: Initial disclosure by Apache Software Foundation