CVE-2026-86537
published 2026-10-02CVE-2026-86537: Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language…
PriorityP350high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.55%
45.5th percentile
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-86537 [HIGH] CWE-191 Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: thrift: Denial of Service via infinite loop in D language bindings
vendor_redhat·2026-10-02·CVSS 8.7
CVE-2026-86537 [HIGH] CWE-835 thrift: thrift: Denial of Service via infinite loop in D language bindings
thrift: thrift: Denial of Service via infinite loop in D language bindings
A flaw was found in Apache Thrift's D language bindings. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted input to an affected application. This input triggers an integer underflow or an unhandled exception, causing the process to enter an infinite loop or terminate unexpectedly.
Package: thrift (Red Hat Ceph Storage 7) - Affected
Package: thrift (Red Hat Ceph Storage 8) - Affected
Package: thrift (Red Hat Ceph Storage 9) - Affected
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings [epel-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-86537 [HIGH] CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings [epel-all]
CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings [fedora-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-86537 [HIGH] CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings [fedora-all]
CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings
bugzilla·2026-10-02·CVSS 8.7
CVE-2026-86537 [HIGH] CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings
CVE-2026-86537 thrift: thrift: Denial of Service via infinite loop in D language bindings
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published