CVE-2026-83663
published 2026-10-02CVE-2026-83663: Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no…
PriorityP348high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.28%
20.0th percentile
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-orchestrator-temporal-rhel9 | — | — |
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
| cryostat | cryostat-storage-rhel9 | — | — |
| grafana | grafana | — | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| openshift-logging | logging-loki-rhel9 | — | — |
| openshift4 | cnf-tests-rhel8 | — | — |
| openshift4 | oc-mirror-plugin-rhel9 | — | — |
| openshift4 | ztp-site-generate-rhel8 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhceph-ci | alloy | — | — |
| rhceph-ci | grafana | — | — |
| rhceph-ci | snmp-notifier | — | — |
| rhceph | alloy-rhel10 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
| rhceph | rhceph-6-dashboard-rhel9 | — | — |
| rhceph | snmp-notifier-rhel10 | — | — |
| rhceph | snmp-notifier-rhel8 | — | — |
| rhceph | snmp-notifier-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-model-registry-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-83663 [HIGH] CWE-674 Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
vendor_redhat·2026-10-02·CVSS 8.7
CVE-2026-83663 [HIGH] CWE-770 github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a loop, exhausting the execution stack. This stack exhaustion causes an unrecoverable fatal error that terminates the entire process.
Package: ansible-automation-platform/automation-orchestrator-temporal-rhel9 (Ansible Automation Orchestrator 2026) - Affected
Package: cryostat/cryostat-storage-rhel9 (Cryostat 4) - Affected
Package: openshift-logging/logging-loki-rhel9 (Logging Subsystem for Red Hat
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83663 golang-github-apache-thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports [fedora-all]
bugzilla·2026-10-06·CVSS 8.7
CVE-2026-83663 [HIGH] CVE-2026-83663 golang-github-apache-thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports [fedora-all]
CVE-2026-83663 golang-github-apache-thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limi
Bugzilla
CVE-2026-83663 migrate: Apache Thrift: Denial of Service via unbounded recursion in Go transports [fedora-all]
bugzilla·2026-10-06·CVSS 8.7
CVE-2026-83663 [HIGH] CVE-2026-83663 migrate: Apache Thrift: Denial of Service via unbounded recursion in Go transports [fedora-all]
CVE-2026-83663 migrate: Apache Thrift: Denial of Service via unbounded recursion in Go transports [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `f
Bugzilla
CVE-2026-83663 github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
bugzilla·2026-10-02·CVSS 8.7
CVE-2026-83663 [HIGH] CVE-2026-83663 github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
CVE-2026-83663 github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published