CVE-2026-66081: Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
Access of Uninitialized Pointer vulnerability in Apache Thrift cglib bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Other sources
Apache Thrift: cglib readmessagebegin leaves output parameters unset for non-versioned messages
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments need to be prioritized for remediation?
Deployments using the Apache Thrift c_glib bindings in versions before 0.25.0 should be prioritized. The provided information does not identify other Thrift language bindings as affected.
What fix is available?
Upgrade Apache Thrift to version 0.25.0. This version fixes the uninitialized pointer issue in the c_glib bindings.