CVE-2026-85493: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)
Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which Apache Thrift deployments are affected?
The issue affects Apache Thrift Dart and Java ME bindings in versions before 0.25.0. Other bindings are not identified as affected in the available information.
What must an attacker be able to do to exploit this issue?
An attacker would need to provide protocol data with attacker-controlled nesting depth that is processed by TProtocolUtil.skip. The recursion can continue to the depth allowed by the stack.
What should teams do to remediate the issue?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue. The provided information does not describe an alternative mitigation if upgrading cannot be done immediately.