CVE-2026-94651: Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift Java bindings before version 0.25.0 are affected. The issue is specifically associated with TSaslNonblockingServer and its Computation.run handling of pre-authentication parse errors.
What condition is required to trigger the issue?
A pre-authentication parse error must occur while the affected TSaslNonblockingServer code processes a connection. The available information does not state whether an unauthenticated remote client can deliberately cause such an error.
What is the impact of the faulty handling?
The affected code can orphan a connection because it does not release a resource after its effective lifetime. This can leave connections improperly retained following a pre-authentication parse error.
What should teams do to remediate the issue?
Upgrade Apache Thrift to version 0.25.0. This version fixes the issue.