Executive brief
Apache Thrift is a software framework used for cross-language services development. A security flaw in its C (GLib) language component could allow an attacker to read data outside of intended memory boundaries. This could lead to unauthorized information disclosure or cause the application to crash, impacting service availability.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the Apache Thrift c_glib bindings. The flaw is located within the GLib-based language library and can be triggered by a remote, unauthenticated attacker over the network. By sending specially crafted data, an attacker can cause the application to read memory beyond the allocated buffer, potentially leading to information leakage or a denial-of-service (DoS) condition. The issue is resolved in Apache Thrift version 0.24.0.
Affected products
- Apache Thrift before 0.24.0
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory