A flaw was found in Apache Thrift. Multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a message containing deeply nested unknown fields, leading to stack exhaustion and causing a Denial of Service (DoS) through an application crash.
Last checked: 2026-10-02 19:43 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-02 16:53 UTC)
Fix evidence last checked: 2026-10-09 03:17 UTC