CVE-2026-61373
published 2026-10-02CVE-2026-61373: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before…
PriorityP348high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.43%
37.0th percentile
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
| rhoai | odh-modelmesh-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
ghsa_unreviewed·2026-10-02
CVE-2026-61373 [HIGH] CWE-770 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
org.apache.thrift/libthrift: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer
vendor_redhat·2026-10-02·CVSS 8.7
CVE-2026-61373 [HIGH] CWE-770 org.apache.thrift/libthrift: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer
org.apache.thrift/libthrift: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer
A flaw was found in Apache Thrift's TSaslNonblockingServer. The component does not properly restrict or throttle resource allocation when processing network requests. A remote, unauthenticated attacker could exploit this vulnerability to exhaust server resources, resulting in a Denial of Service (DoS).
Package: libthrift (Red Hat Fuse 7) - Affected
Package: rhoai/odh-modelmesh-rhel9 (Red Hat OpenShift AI (RHOAI)) - Affected
Package: rhoai/odh-spark-operator-rhel9 (Red Hat OpenShift AI (RHOAI)) - Affected
Package: rhoai/odh-th06-cpu-torch210-py312-rhel9 (Red Hat OpenShift AI (RHOAI)) - Affected
Package: rhoai/odh-th06-cpu-torch291-py312-rhel9 (Red Hat OpenShift AI
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-61373 python-avro: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer [fedora-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-61373 [HIGH] CVE-2026-61373 python-avro: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer [fedora-all]
CVE-2026-61373 python-avro: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-61373 org.apache.thrift/libthrift: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer
bugzilla·2026-10-02·CVSS 8.7
CVE-2026-61373 [HIGH] CVE-2026-61373 org.apache.thrift/libthrift: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer
CVE-2026-61373 org.apache.thrift/libthrift: Apache Thrift: Denial of Service via unbounded resource allocation in TSaslNonblockingServer
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published