CVE-2026-61374: Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit

Q: Which deployments are affected?

Apache Thrift Java bindings versions before 0.25.0 are affected. The available information does not identify specific server configurations or applications beyond use of the Java bindings.

Q: What should teams do to remediate this issue?

Upgrade Apache Thrift Java bindings to version 0.25.0, which fixes the issue.

Published Oct 2, 2026

Updated

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected Software

1 affected component

Apache Thrift Java bindings<0.25.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Thrift Java bindings to a version that resolves this vulnerability.
Fixed in 0.25.0

Event History

Oct 2, 2026

CVE Published

via MITRE·12:53 PM

Data Sourced

via MITRE·12:53 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Apache Thrift Java bindings versions before 0.25.0 are affected. The available information does not identify specific server configurations or applications beyond use of the Java bindings.

What should teams do to remediate this issue?

Upgrade Apache Thrift Java bindings to version 0.25.0, which fixes the issue.

CVE-2026-61374: Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What should teams do to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What should teams do to remediate this issue?