Executive brief
Apache Thrift, a framework used for scalable cross-language services development, contains a critical security flaw in its C++ components. An attacker could exploit this vulnerability to crash services or potentially execute unauthorized code on the system. Organizations using the C++ bindings of Apache Thrift should update to version 0.24.0 immediately to protect their infrastructure and data.
Technical details
A heap-based buffer overflow (CWE-122) exists in the C++ bindings of Apache Thrift. The vulnerability is located within the C++ library components used for data serialization and communication. A remote, unauthenticated attacker can exploit this flaw over the network without user interaction. Successful exploitation could lead to memory corruption, resulting in a crash (denial of service) or arbitrary code execution. The issue is resolved in Apache Thrift version 0.24.0.
Affected products
- Apache Software Foundation Apache Thrift before 0.24.0
Timeline
- 2026-07-27: advisory: NVD and Apache Software Foundation published the advisory.
- 2026-07-27: patched: Version 0.24.0 released to address the vulnerability.