REDHAT-BUG-2545170: High severity Apache Thrift vulnerability

Q: Which deployments are exposed to this denial-of-service issue?

Deployments using Apache Thrift Go bindings before version 0.25.0 are affected. The issue applies to both Go transports: TFramedTransport and THeaderTransport.

Q: What must an attacker be able to do to trigger the crash?

An attacker must be able to act as a peer and send crafted frames to the affected Go transport. A zero-length declared frame triggers the condition in TFramedTransport, while a header block that fills the frame triggers it in THeaderTransport.

Q: What happens when exploitation succeeds?

Repeated recursive Read calls exhaust the Go stack, causing a fatal error that terminates the entire process. The failure cannot be handled with recover().

Q: What is the available remediation?

Upgrade Apache Thrift to version 0.25.0, which fixes the uncontrolled recursion.

Published Oct 2, 2026

Updated

Uncontrolled Recursion vulnerability in Apache Thrift go bindings.

Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport (a declared size of zero) or 18 bytes in THeaderTransport (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a fatal error, which recover() cannot catch, so the whole process dies.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected Software

1 affected component

Apache Thrift<0.25.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Thrift to a version that resolves this vulnerability.
Fixed in 0.25.0

Event History

Oct 2, 2026

Data Sourced

via Red Hat·12:58 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Deployments using Apache Thrift Go bindings before version 0.25.0 are affected. The issue applies to both Go transports: TFramedTransport and THeaderTransport.

What must an attacker be able to do to trigger the crash?

An attacker must be able to act as a peer and send crafted frames to the affected Go transport. A zero-length declared frame triggers the condition in TFramedTransport, while a header block that fills the frame triggers it in THeaderTransport.

What happens when exploitation succeeds?

Repeated recursive Read calls exhaust the Go stack, causing a fatal error that terminates the entire process. The failure cannot be handled with recover().

What is the available remediation?

Upgrade Apache Thrift to version 0.25.0, which fixes the uncontrolled recursion.

REDHAT-BUG-2545170: High severity Apache Thrift vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What must an attacker be able to do to trigger the crash?

What happens when exploitation succeeds?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What must an attacker be able to do to trigger the crash?

What happens when exploitation succeeds?

What is the available remediation?