CVE-2026-63772
published 2026-10-02CVE-2026-63772: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
PriorityP348high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.32%
24.3th percentile
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/apache/thrift: Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
vendor_redhat·2026-10-02·CVSS 8.7
CVE-2026-63772 [HIGH] CWE-770 github.com/apache/thrift: Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
github.com/apache/thrift: Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in the Apache Thrift Go bindings. A remote attacker can exploit this vulnerability by sending specially crafted requests that trigger excessive resource allocation without proper restrictions. This uncontrolled consumption can exhaust system resources, leading to a Denial of Service (DoS).
Package: grafana12.4 (Red Hat Hardened Images) - Not affected
Package: grafana13.1 (Red Hat Hardened Images) - Not affected
Package: gra
VulDB
Apache Thrift input validation (EUVD-2026-91628)
vuldb·2026-10-04·CVSS 8.7
CVE-2026-63772 [HIGH] Apache Thrift input validation (EUVD-2026-91628)
A vulnerability classified as problematic was found in Apache Thrift. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper input validation.
This vulnerability is registered as CVE-2026-63772. It is possible to launch the attack remotely. No exploit is available.
GHSA
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-63772 [HIGH] CWE-770 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-10-02
Published