Description
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Published: 2026-10-02
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via infinite loop that hogs CPU and blocks I/O
Action: Immediate Patch
AI Analysis

Impact

Apache Thrift’s Python TNonblockingServer can enter an endless busy‑loop when it receives a frame that lands on an 8192‑byte boundary. The loop has an unreachable exit condition, causing the server to consume CPU cycles and stop selecting any file descriptors. The result is a denial of service, as the server no longer processes further requests and becomes unresponsive.

Affected Systems

The vulnerability is present in all Apache Thrift releases prior to 0.25.0. Users running any earlier 0.24.x or older version of the Thrift python bindings are affected.

Risk and Exploitability

The CVSS score of 8.2 signals a high severity vulnerability. EPSS information is not available and the issue is not listed in CISA KEV. Attackers who can reach the TNonblockingServer instance can trigger the bug by sending a crafted request frame of the problematic size, leading to service outage until the software is upgraded.

Generated by OpenCVE AI on October 2, 2026 at 14:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Thrift to version 0.25.0 or later and deploy the updated binary
  • Replace any deployments of older Thrift binaries with the upgraded version so that all running instances use the fixed code
  • Restart services that use the Thrift binding to load the new code

Generated by OpenCVE AI on October 2, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 04 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift

Sat, 03 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Title Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame
Weaknesses CWE-835
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Thrift
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-02T17:25:06.026Z

Reserved: 2026-09-21T23:27:41.352Z

Link: CVE-2026-94654

cve-icon Vulnrichment

Updated: 2026-10-02T17:24:50.658Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T13:18:01.987

Modified: 2026-10-02T18:17:08.107

Link: CVE-2026-94654

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:54:16Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')