CVE-2026-66331: Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
Published Oct 2, 2026
·Updated
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Other sources
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
— Microsoft
Affected Software
2 affected componentsFixes available
Apache Thrift<0.25.0
Microsoft azl3 thrift 0.24.0-1<0.25.0-1
0.25.0-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Oct 2, 2026
CVE Published
via MITRE·12:32 PM
Data Sourced
via MITRE·12:32 PM
DescriptionWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Oct 7, 2026
Data Sourced
via Microsoft·08:44 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which deployments are affected?
The issue affects Apache Thrift Delphi bindings that use the buffered transport in versions before 0.25.0.
2
What is the remediation?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue.