DEBIAN-CVE-2026-83663
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-83663
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-83663.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-83663
- Upstream
- CVE-2026-83663
- Published
- 2026-10-02T13:17:58Z
- Modified
- 2026-10-03T05:00:20Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call
Readagain instead of looping. A peer produces such a frame for 4 bytes inTFramedTransport(a declared size of zero) or 18 bytes inTHeaderTransport(a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as afatal error, whichrecover()cannot catch, so the whole process dies. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue. - References
Affected packages
Debian:12 / thrift
Package
- Name
- thrift
- Purl
- pkg:deb/debian/thrift?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / thrift
Package
- Name
- thrift
- Purl
- pkg:deb/debian/thrift?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / thrift
Package
- Name
- thrift
- Purl
- pkg:deb/debian/thrift?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected