# CVE-2026-66858: Apache Thrift stack overflow in protocol skip routine

Source: https://junglewise.ai/threats/cve-2026-66858-the-protocol-skip-routine-in-several-apache-thrift-bindings-did  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-66858 · Severity: info · Published 2026-10-02

Apache Thrift's protocol skip routines in several language bindings fail to enforce recursion limits, allowing deeply nested unknown fields in a message to exhaust the stack and crash the application. This affects applications using Python C++ accelerator, PHP, Perl, Lua, Smalltalk, and OCaml bindings, causing denial of service from a remote attacker sending a specially crafted message.

Technologies: [Apache Thrift](https://junglewise.ai/threats/technologies/thrift). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-66858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66858 being exploited in the wild.

**How severe is CVE-2026-66858?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Apache Thrift before 0.25.0; Apache Thrift PHP library before 0.25.0; Apache Thrift Python C++ accelerator before 0.25.0.

**Is there a fix for CVE-2026-66858?** Yes: fixed in 0.25.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66858 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66858?** Check whether you run Apache Thrift, Apache Thrift PHP library or Apache Thrift Python C++ accelerator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.25.0

## Technical details

The protocol skip routine does not apply the binding's configured recursion limit when processing nested fields, allowing stack exhaustion via deeply nested message structures. This affects the Python C++ accelerator, PHP library and thrift_protocol extension, and Perl, Lua, Smalltalk, and OCaml libraries. An attacker can trigger a stack overflow and application crash by sending a network message with excessive field nesting, no authentication required.

## Affected products

- Apache Thrift before 0.25.0
- Apache Thrift Python C++ accelerator before 0.25.0
- Apache Thrift PHP library before 0.25.0

## Timeline

- 2026-10-02: disclosed

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://packagist.org/](https://packagist.org/)

## Related threats

- [Apache Thrift uncontrolled recursion in Java bindings](https://junglewise.ai/threats/cve-2026-120135-uncontrolled-recursion-vulnerability-in-apache-thrift-java)
- [Apache Thrift uncontrolled recursion in PHP bindings](https://junglewise.ai/threats/cve-2026-96289-uncontrolled-recursion-vulnerability-in-apache-thrift-php)
- [Apache Thrift Perl bindings inefficient algorithmic complexity](https://junglewise.ai/threats/cve-2026-96287-inefficient-algorithmic-complexity-vulnerability-in-apache-thrift)
- [Apache Thrift uncaught exception in Perl bindings](https://junglewise.ai/threats/cve-2026-96286-uncaught-exception-vulnerability-in-apache-thrift-perl-bindings)
- [Apache Thrift Ruby bindings exception handling vulnerability](https://junglewise.ai/threats/cve-2026-96277-uncaught-exception-improper-handling-of-exceptional-conditions)