CVE-2026-83632
published 2026-10-02CVE-2026-83632: Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue…
PriorityP352critical9.2CVSS 4.0
AVNACHATPPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.38%
30.6th percentile
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-orchestrator-temporal-rhel9 | — | — |
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
| cryostat | cryostat-storage-rhel9 | — | — |
| grafana | grafana | — | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| openshift-logging | logging-loki-rhel9 | — | — |
| openshift4 | cnf-tests-rhel8 | — | — |
| openshift4 | oc-mirror-plugin-rhel9 | — | — |
| openshift4 | ztp-site-generate-rhel8 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhceph | alloy-rhel10 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
| rhceph | rhceph-6-dashboard-rhel9 | — | — |
| rhceph | snmp-notifier-rhel10 | — | — |
| rhceph | snmp-notifier-rhel8 | — | — |
| rhceph | snmp-notifier-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-model-registry-rhel9 | — | — |
| rhosdt | opentelemetry-collector-rhel9 | — | — |
| rhosdt | tempo-jaeger-query-rhel9 | — | — |
| rhosdt | tempo-query-rhel9 | — | — |
CVSS provenance
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.2CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
ghsa_unreviewed·2026-10-02
CVE-2026-83632 [CRITICAL] CWE-122 Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
github.com/apache/thrift: Apache Thrift: C++ THttpTransport grows its line buffer without bound
vendor_redhat·2026-10-02·CVSS 9.2
CVE-2026-83632 [CRITICAL] CWE-787 github.com/apache/thrift: Apache Thrift: C++ THttpTransport grows its line buffer without bound
github.com/apache/thrift: Apache Thrift: C++ THttpTransport grows its line buffer without bound
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in Apache Thrift. An integer overflow and lack of resource limits can cause a heap-based buffer overflow, where incoming data exceeds allocated memory boundaries. A remote attacker could exploit this vulnerability by sending specially crafted requests to corrupt memory, resulting in a Denial of Service (DoS).
Statement: This vulnerability is rated as Moderate impact for Red Hat products because triggering the fl
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83632 golang-github-apache-thrift: Apache Thrift: C++ THttpTransport grows its line buffer without bound [fedora-all]
bugzilla·2026-10-09·CVSS 9.2
CVE-2026-83632 [CRITICAL] CVE-2026-83632 golang-github-apache-thrift: Apache Thrift: C++ THttpTransport grows its line buffer without bound [fedora-all]
CVE-2026-83632 golang-github-apache-thrift: Apache Thrift: C++ THttpTransport grows its line buffer without bound [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-83632 migrate: Apache Thrift: C++ THttpTransport grows its line buffer without bound [fedora-all]
bugzilla·2026-10-09·CVSS 9.2
CVE-2026-83632 [CRITICAL] CVE-2026-83632 migrate: Apache Thrift: C++ THttpTransport grows its line buffer without bound [fedora-all]
CVE-2026-83632 migrate: Apache Thrift: C++ THttpTransport grows its line buffer without bound [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-83632 thrift: Apache Thrift: Denial of Service via crafted HTTP requests
bugzilla·2026-10-02·CVSS 9.2
CVE-2026-83632 [CRITICAL] CVE-2026-83632 thrift: Apache Thrift: Denial of Service via crafted HTTP requests
CVE-2026-83632 thrift: Apache Thrift: Denial of Service via crafted HTTP requests
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published