Executive brief
Apache Thrift is a software framework used for cross-language services development, allowing different systems to communicate efficiently. A vulnerability in its C++ components could allow a remote attacker to crash applications using the library by sending specially crafted input. This could lead to a service outage, impacting business operations that rely on these interconnected services.
Technical details
An out-of-bounds read vulnerability exists in the Apache Thrift C++ bindings due to improper validation of specified quantities in input (CWE-1284, CWE-125). A remote, unauthenticated attacker can exploit this by sending malformed data over the network that specifies an incorrect size or quantity for an input field. This causes the application to read memory outside of the intended buffer, typically resulting in a crash (Denial of Service). The issue is fixed in version 0.24.0.
Affected products
- Apache Software Foundation Thrift before 0.24.0
Timeline
- 2026-07-27: advisory: CVE-2026-58662 published by Apache Software Foundation
- 2026-07-27: patched: Version 0.24.0 released to address the vulnerability