{"id":"CVE-2026-120135","kind":"vulnerability","aliases":["CVE-2026-120135"],"related":[],"title":"Apache Thrift Java bindings: uncontrolled recursion crashes or stalls services","description":"Uncontrolled Recursion vulnerability in Apache Thrift Java bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.24.0.\n\n\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue.","summary":"Apache Thrift's Java bindings recurse without limit while handling certain input, which can exhaust the stack. An attacker who can send crafted data to a Thrift service can crash it or make it unresponsive.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-thrift","java","package","rpc-services"],"not_affected_if":["no-thrift-in-use","non-java-bindings"],"how_to_check":"- Check the Thrift Java library version in your build file (for example `libthrift` in Maven or Gradle) and confirm whether it is below `0.24.0`.\n- Look for services that deserialize Thrift messages from untrusted network clients.","fix":"- Apache Thrift Java bindings: upgrade to `0.24.0`.","status":"open","published_at":"2026-10-31T21:16:53+00:00","first_seen_at":"2026-10-31T21:37:09+00:00","triaged_at":"2026-10-31T21:39:03+00:00","updated_at":"2026-10-31T21:39:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-31T21:39:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Thrift Java bindings: upgrade to `0.24.0`.","reach":"network","title":"Apache Thrift Java bindings: uncontrolled recursion crashes or stalls services","impact":"medium","summary":"Apache Thrift's Java bindings recurse without limit while handling certain input, which can exhaust the stack. An attacker who can send crafted data to a Thrift service can crash it or make it unresponsive.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-thrift","rpc-services"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Service crashes or becomes unresponsive from stack exhaustion","analyst_note":"","how_to_check":"- Check the Thrift Java library version in your build file (for example `libthrift` in Maven or Gradle) and confirm whether it is below `0.24.0`.\n- Look for services that deserialize Thrift messages from untrusted network clients.","plain_action":"","needs_analyst":false,"not_affected_if":["non-java-bindings","no-thrift-in-use"],"who_is_affected":"Applications that use the Apache Thrift Java bindings below `0.24.0` to parse Thrift messages, especially servers that accept requests from untrusted clients. Teams not using the Java bindings, or whose Thrift endpoints are only reachable by trusted internal callers, are less exposed. Whether the sources name a specific trigger is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4097,"output_tokens":552,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120135':13A,16A '-2026':12A,15A '0.24.0':74C,82C 'affect':70C 'apach':1A,18B,25B,64C,71C 'apache-thrift':17B 'attack':43B 'bind':4A,29B,67C 'certain':35B 'craft':47B 'crash':7A,54B 'cve':11A,14A 'data':48B 'exhaust':39B 'fix':84C 'handl':34B 'input':36B 'issu':69C,86C 'java':3A,20B,28B,66C 'limit':32B 'make':57B 'packag':21B 'recommend':77C 'recurs':6A,30B,61C 'rpc':23B 'rpc-servic':22B 'send':46B 'servic':10A,24B,52B 'stack':41B 'stall':9A 'thrift':2A,19B,26B,51B,65C,72C 'uncontrol':5A,60C 'unrespons':59B 'upgrad':79C 'user':75C 'version':81C 'vulner':62C 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Apache Thrift Java bindings below `0.24.0` to parse Thrift messages, especially servers that accept requests from untrusted clients. Teams not using the Java bindings, or whose Thrift endpoints are only reachable by trusted internal callers, are less exposed. Whether the sources name a specific trigger is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T21:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120135","severity":null,"published_at":"2026-10-31T21:16:53+00:00","modified_at":"2026-10-31T21:16:53+00:00","first_seen_at":"2026-10-31T21:37:09+00:00","fetched_at":"2026-10-31T21:37:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}