Live › vulnerability › CVE-2026-120135
Apache Thrift's Java bindings recurse without limit while handling certain input, which can exhaust the stack. An attacker who can send crafted data to a Thrift service can crash it or make it unresponsive.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 21:37 UTC. All times on this page are UTC.
Applications that use the Apache Thrift Java bindings below 0.24.0 to parse Thrift messages, especially servers that accept requests from untrusted clients. Teams not using the Java bindings, or whose Thrift endpoints are only reachable by trusted internal callers, are less exposed. Whether the sources name a specific trigger is unknown.
No product ranges from the sources yet.
libthrift in Maven or Gradle) and confirm whether it is below 0.24.0.0.24.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-120135")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.