CVE-2026-96277: Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception
Apache Thrift: Ruby SimpleServer ends serve() on any non-Transport/Protocol exception
Other sources
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thrift Ruby bindingsto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift deployments using the Ruby bindings with SimpleServer are affected if they run a version before 0.25.0.
What is the impact of triggering the issue?
A non-Transport/Protocol exception that is not caught causes Ruby SimpleServer to end its serve() loop.
What should teams do to remediate this issue?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue.