Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
Apache Thrift: C++ THeaderTransport::transform() heap buffer overflow (write direction)
Apache Thrift: Go THeaderTransport does not bound the inflated size of a ZLIB frame
Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport (a declared size of zero) or 18 bytes in THeaderTransport (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a fatal error, which recover() cannot catch, so the whole process dies.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Apache Thrift: Node.js skip() recursion
Apache Thrift: Go TFramedTransport uint32 overflow
Apache Thrift: cglib dispatch stack overflow
Apache Thrift: C++ JSON OOB read
Apache Thrift: Java TSSLTransportFactory hostname verification
Apache Thrift: Swift Compact Protocol integer overflow
Apache Thrift: Swift Range crash in skip()
Apache Thrift: Specially crafted input can crash a cglib Thrift server with invalid pointer error.
Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote attacker could exploit this vulnerability to cause a large memory allocation.
Affected versions of the thrift crate size a buffer directly from an attacker-controlled 4-byte length read off the wire, before reading any payload and with no upper bound, allowing a hostile peer to force a large eager allocation or an immediate abort (denial of service, CWE-400 / CWE-789). This is the Rust implementation's instance of the CVE-2020-13949 pattern, published by the Apache Thrift PMC as CVE-2026-43868.
Details
In TBinaryInputProtocol::readbytes (src/protocol/binary.rs), the length is read as a i32 from the transport and cast straight to usize to size a zeroing buffer before any payload is read:
rust fn readbytes(&mut self) -> crate::Result<Vec<u8>> { let numbytes = self.transport.readi32::<BigEndian>()? as usize; // length from the wire let mut buf = vec![0u8; numbytes]; // unbounded eager allocation self.transport.readexact(&mut buf).map(|| buf).maperr(From::from) }
There is no check that numbytes is non-negative or that it fits within the data actually available:
- A length of 0x7FFFFFFF forces a ~2 GiB allocation; 0x20000000 forces 512 MiB; and so on, from only a 4-byte input. - A negative length casts to a huge usize (up to usize::MAX), causing an immediate allocation failure / abort.
readstring routes through readbytes, so string fields are affected the same way. The sink is reachable from any peer sending binary-protocol data, so this is an unauthenticated, network-reachable denial of service.
The fix
From thrift 0.23.0 onward, readbytes goes through readbinarylen, which rejects negative sizes and enforces TConfiguration::maxstringsize (default 100 MiB), alongside default message, frame, and recursion limits.
A separate, related gap on the non-strict message-name path was published as CVE-2026-58389 and fixed in 0.24.0; this advisory covers the readbytes unbounded allocation (CVE-2026-43868), fixed in 0.23.0.
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)
Apache Thrift: Python TZlibTransport stops enforcing its decompressed-size limit once the limit is exactly used up
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
Apache Thrift: cglib heap out-of-bounds read in transport leftover-bytes path
Apache Thrift: Python TSSLSocket Hostname Matcher Import
Apache Thrift: cglib TLS Client Missing Hostname Verification
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.