https://seclists.org/oss-sec/2026/q3/261 - CVE-2026-43871: Apache Thrift: TCompactProtocol varint byte-count limit

CVE-2026-43871 is classified as a critical vulnerability that can lead to an infinite loop condition in Apache Thrift.

To fix CVE-2026-43871, upgrade Apache Thrift to version 0.24.0 or later.

CVE-2026-43871 affects all versions of Apache Thrift before 0.24.0.

An attacker could exploit CVE-2026-43871 to create a denial-of-service condition by causing an infinite loop in the application.

CVE-2026-43871 was published on July 24, 2026.

Affected Software

1 affected component

Apache Thrift<0.24.0

1

CVE-2026-43871 is classified as a critical vulnerability that can lead to an infinite loop condition in Apache Thrift.

2

To fix CVE-2026-43871, upgrade Apache Thrift to version 0.24.0 or later.

3

CVE-2026-43871 affects all versions of Apache Thrift before 0.24.0.

4

An attacker could exploit CVE-2026-43871 to create a denial-of-service condition by causing an infinite loop in the application.

5

CVE-2026-43871 was published on July 24, 2026.