Description
NULL pointer dereference vulnerability in Apache Thrift PHP bindings.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Published: 2026-10-02
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability involves a null pointer dereference within the Apache Thrift PHP bindings, which may occur when a client sends a request containing a missing container‑element specification. This flaw can cause the PHP interpreter to crash or, in the worst case, allow arbitrary code execution on the hosting server, thereby compromising confidentiality, integrity, and availability. The weakness is categorized as CWE‑476.

Affected Systems

All installations of Apache Thrift with PHP bindings released before version 0.25.0 are affected. This includes any system using the PHP Thrift client or server libraries bundled with those earlier releases.

Risk and Exploitability

With a CVSS score of 8.7, this issue is rated as high severity. No EPSS score is currently available, and the vulnerability has not been listed in the CISA KEV catalog. The exploit requires an attacker to initiate a Thrift connection and transmit a specially crafted message; as such, the attack vector is remote over the network. Given the exploitability and severity, the risk remains significant for all vulnerable deployments.

Generated by OpenCVE AI on October 2, 2026 at 12:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Thrift to version 0.25.0 or later to eliminate the null pointer dereference.
  • If an upgrade cannot be performed immediately, restrict external Thrift traffic to a controlled network segment or firewall rule to limit exposure to potential malicious clients.
  • Implement application‑level monitoring to detect and alert on PHP crashes or abnormal process termination that may indicate an attempted exploitation.

Generated by OpenCVE AI on October 2, 2026 at 12:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 03 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift

Fri, 02 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Title Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Thrift
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-02T17:33:40.379Z

Reserved: 2026-09-08T21:10:32.811Z

Link: CVE-2026-87117

cve-icon Vulnrichment

Updated: 2026-10-02T17:33:33.869Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T12:17:22.370

Modified: 2026-10-02T18:17:06.840

Link: CVE-2026-87117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T14:44:25Z

Weaknesses