CVE-2026-66331
published 2026-10-02CVE-2026-66331: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift…
PriorityP336medium6.9CVSS 4.0
AVNACLATNPRNUINVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.28%
20.0th percentile
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Thrift Transport buffer overflow (EUVD-2026-91587)
vuldb·2026-10-04·CVSS 6.9
CVE-2026-66331 [MEDIUM] Apache Thrift Transport buffer overflow (EUVD-2026-91587)
A vulnerability has been found in Apache Thrift and classified as critical. This issue affects some unknown processing of the component Transport. This manipulation causes buffer overflow.
This vulnerability appears as CVE-2026-66331. The attack may be initiated remotely. There is no available exploit.
GHSA
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
ghsa_unreviewed·2026-10-02
CVE-2026-66331 [MEDIUM] CWE-770 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport
vendor_redhat·2026-10-02·CVSS 6.9
CVE-2026-66331 [MEDIUM] CWE-770 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport
thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport
A flaw was found in Apache Thrift's Delphi bindings buffered transport. The component fails to properly restrict or throttle resource allocation when processing input. A remote, unauthenticated attacker could exploit this vulnerability to consume excessive system resources, resulting in a Denial of Service (DoS).
Package: thrift (Red Hat Ceph Storage 7) - Fix deferred
Package: thrift (Red Hat Ceph Storage 8) - Fix deferred
Package: thrift (Red Hat Ceph Storage 9) - Out of support scope
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Fix deferred
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-66331 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport [fedora-all]
bugzilla·2026-10-22·CVSS 6.9
CVE-2026-66331 [MEDIUM] CVE-2026-66331 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport [fedora-all]
CVE-2026-66331 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-66331 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport [epel-all]
bugzilla·2026-10-22·CVSS 6.9
CVE-2026-66331 [MEDIUM] CVE-2026-66331 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport [epel-all]
CVE-2026-66331 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published