Description
Uncaught exception vulnerability in Apache Thrift Perl bindings.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Published: 2026-10-02
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

An uncaught exception in older versions of Apache Thrift Perl bindings causes the server to terminate the serve() loop after a single failed connection. Because the exception is not handled, the server process shuts down, stopping all subsequent requests. The weakness is classified as an Improper Exception Handled (CWE-248) condition.

Affected Systems

The issue impacts Apache Thrift Perl bindings provided by the Apache Software Foundation, affecting all releases prior to 0.25.0. Users running versions earlier than 0.25.0 should upgrade to the fixed release or later.

Risk and Exploitability

The CVSS score of 8.2 indicates a high risk to availability. While the EPSS score is not available, the lack of a KEV listing suggests the vulnerability is not widely exploited yet. An attacker can exploit the flaw by initiating a TCP/IP connection that causes the server to throw an uncaught exception, after which the server will terminate. No additional privileges or payload execution are required for the denial of service.

Generated by OpenCVE AI on October 2, 2026 at 14:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Apache Thrift 0.25.0 or later.
  • Restart the Perl Thrift server to apply the new version.
  • Simulate a failing connection to confirm the serve() loop continues without termination.

Generated by OpenCVE AI on October 2, 2026 at 14:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift

Fri, 02 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Title Apache Thrift: Perl servers end `serve()` when serving one connection fails
Weaknesses CWE-248
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Thrift
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-02T13:40:01.647Z

Reserved: 2026-09-22T21:11:43.121Z

Link: CVE-2026-96286

cve-icon Vulnrichment

Updated: 2026-10-02T13:39:34.495Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T13:18:05.247

Modified: 2026-10-02T14:30:28.440

Link: CVE-2026-96286

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T15:00:10Z

Weaknesses