Description
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Published: 2026-10-02
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unstable server behavior with possible denial of service due to uninitialized resource usage
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Apache Thrift’s C++ WebSocket server transport causes the server to read an incomplete request length, resulting in the use of uninitialized resources and the return of incorrect status codes. This flaw can lead to inconsistent server responses, unexpected crashes, or a denial‑of‑service condition. While the description does not suggest code execution, the improper handling of requests undermines reliability and could be leveraged by an attacker to exhaust server resources.

Affected Systems

Apache Thrift versions prior to 0.25.0 are affected. The vulnerability applies to the C++ WebSocket server transport implementation distributed by the Apache Software Foundation. No specific sub‑versions or platform restrictions are mentioned.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw remotely by sending malformed WebSocket frames to a publicly exposed Thrift service, potentially causing the server to crash or exhibit erratic behavior. No proof of exploit is provided in the advisory, but the risk stems from unstable handling of client requests.

Generated by OpenCVE AI on October 2, 2026 at 13:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Thrift to version 0.25.0 or later, which removes the uninitialized resource usage and corrects the status code handling.
  • Configure the WebSocket server to enforce complete request length validation or adjust transport settings to reject incomplete frames before processing.
  • Monitor server logs for unexpected status codes or frequent crashes and restart the process if stability issues are detected.

Generated by OpenCVE AI on October 2, 2026 at 13:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 04 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift

Fri, 02 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Title Apache Thrift: C++ WebSocket server transport does not read a full request length
Weaknesses CWE-393
CWE-908
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Apache Thrift
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-02T13:54:38.203Z

Reserved: 2026-09-16T22:47:54.307Z

Link: CVE-2026-92834

cve-icon Vulnrichment

Updated: 2026-10-02T13:54:31.683Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T12:17:22.647

Modified: 2026-10-02T14:30:28.440

Link: CVE-2026-92834

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:54:21Z

Weaknesses
  • CWE-393

    Return of Wrong Status Code

  • CWE-908

    Use of Uninitialized Resource