A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) against the Node.js and D WebSocket server transports by sending a frame specifying an excessively large payload length. Because the server immediately allocates the declared amount of memory without verifying that the payload data has arrived, an attacker can rapidly exhaust system memory and crash the service.
Last checked: 2026-10-02 19:43 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-02 17:16 UTC)
Fix evidence last checked: 2026-10-09 19:55 UTC