UBUNTU-CVE-2026-120135: High severity ubuntu/thrift vulnerability
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.24.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Apache Thrift Java bindings before version 0.24.0 are affected. The provided information identifies the Ubuntu package as ubuntu/thrift but does not specify affected Ubuntu releases or package versions.
What does an attacker need to exploit the vulnerability?
The severity vector indicates network attack access, low attack complexity, no privileges, and no user interaction. It also indicates attack requirements are present, but the provided data does not define those requirements.
What is the impact of successful exploitation?
The reported impact is high availability impact, with no reported impact to confidentiality or integrity. The issue is an uncontrolled recursion vulnerability, which can cause availability loss.
What should teams do to remediate it?
Upgrade Apache Thrift to version 0.24.0, which fixes the issue. The provided data does not describe an alternative mitigation when an upgrade cannot be applied immediately.