CVE-2026-92834: Apache Thrift: C++ WebSocket server transport does not read a full request length
Apache Thrift: C++ WebSocket server transport does not read a full request length
Other sources
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift deployments using the C++ WebSocket server transport are affected if they run a version before 0.25.0. The provided information does not indicate that other Thrift language bindings or transports are affected.
What is the recommended remediation?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue.