CVE-2026-96990
published 2026-10-02CVE-2026-96990: Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
PriorityP344high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.37%
31.1th percentile
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-96990 [HIGH] CWE-770 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
vendor_redhat·2026-10-02·CVSS 8.2
CVE-2026-96990 [HIGH] CWE-770 thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
thrift: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in Apache Thrift's Erlang bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending requests that trigger excessive resource allocation without proper limits or throttling. This issue can lead to resource exhaustion, resulting in a Denial of Service (DoS).
Package: thrift (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
2026-10-02
Published