Description
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Published: 2026-07-27
Score: 8.7 High
EPSS: 1.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An infinite loop condition exists in the TCompactProtocol implementation of Apache Thrift, triggered by malformed varint byte-count values. This flaw can cause the server to consume excessive CPU and memory, leading to service disruption or crash without compromising confidentiality or integrity.

Affected Systems

All Apache Thrift distributions prior to version 0.24.0 across Python, Go, PHP, and Java bindings are vulnerable. The issue affects any system that processes client input using the TCompactProtocol for serialization and deserialization.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating a high severity. The EPSS score of 1% suggests a low yet non‑zero probability of exploitation, and the flaw is not listed in CISA KEV. Attackers can potentially exploit it by sending specifically crafted TCompactProtocol messages to a service that accepts such input, resulting in an unrecoverable infinite loop.

Generated by OpenCVE AI on August 4, 2026 at 14:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Thrift to version 0.24.0 or later on all affected services.
  • Recompile or redeploy any custom applications or services that depend on Thrift bindings to ensure the updated libraries are used.
  • Configure and enable application‑level rate limiting to prevent excessive processing of malformed requests.

Generated by OpenCVE AI on August 4, 2026 at 14:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Mon, 27 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift

Mon, 27 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Title Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Weaknesses CWE-835
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Thrift
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-27T13:01:39.993Z

Reserved: 2026-05-04T14:27:51.562Z

Link: CVE-2026-43871

cve-icon Vulnrichment

Updated: 2026-07-27T11:07:17.843Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T12:16:44.413

Modified: 2026-07-27T19:51:36.197

Link: CVE-2026-43871

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-27T10:56:15Z

Links: CVE-2026-43871 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T14:15:10Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')