BIT-thrift-2026-83663

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/thrift/BIT-thrift-2026-83663.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-thrift-2026-83663

Aliases

CVE-2026-83663

Published

2026-10-09T10:52:59Z

Modified

2026-10-09T12:00:11Z

Summary

Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)

Details

Uncontrolled Recursion vulnerability in Apache Thrift go bindings.

Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport (a declared size of zero) or 18 bytes in THeaderTransport (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a fatal error, which recover() cannot catch, so the whole process dies.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Database specific

{
    "cpes": [
        "cpe:2.3:a:apache:thrift:*:*:*:*:*:go:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / thrift

Package

Name: thrift
Purl: pkg:bitnami/thrift

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.25.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/thrift/BIT-thrift-2026-83663.json"