CVE-2026-96286: Apache Thrift: Perl servers end `serve()` when serving one connection fails
Apache Thrift: Perl servers end serve() when serving one connection fails
Other sources
Uncaught exception vulnerability in Apache Thrift Perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift deployments using the Perl bindings before version 0.25.0 are affected. The issue concerns Perl servers handling connections through serve().
What is the impact of a failed connection?
An uncaught exception while serving a single connection can cause the Perl server's serve() operation to end, interrupting service for subsequent connections.
What should teams do to remediate the issue?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue.