CVE-2026-66858
published 2026-10-02CVE-2026-66858: The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough…
PriorityP351high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.26%
17.2th percentile
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack.
ghsa_unreviewed·2026-10-02
CVE-2026-66858 [HIGH] CWE-674 The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack.
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: Apache Thrift: Denial of Service via deeply nested unknown fields
vendor_redhat·2026-10-02·CVSS 8.7
CVE-2026-66858 [HIGH] CWE-770 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields
thrift: Apache Thrift: Denial of Service via deeply nested unknown fields
A flaw was found in Apache Thrift. Multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a message containing deeply nested unknown fields, leading to stack exhaustion and causing a Denial of Service (DoS) through an application crash.
Package: thrift (Red Hat Ceph Storage 7) - Affected
Package: thrift (Red Hat Ceph Storage 8) - Affected
Package: thrift (Red Hat Ceph Storage 9) - Affected
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields [epel-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-66858 [HIGH] CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields [epel-all]
CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, whic
Bugzilla
CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields [fedora-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-66858 [HIGH] CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields [fedora-all]
CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, wh
Bugzilla
CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields
bugzilla·2026-10-02·CVSS 8.7
CVE-2026-66858 [HIGH] CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields
CVE-2026-66858 thrift: Apache Thrift: Denial of Service via deeply nested unknown fields
The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published