{"id":"CVE-2026-121824","kind":"vulnerability","aliases":["CVE-2026-121824"],"related":[],"title":"Armeria: malformed Thrift messages can exhaust memory and crash a service","description":"A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service.","summary":"Armeria, a Java library for building network services, allocates excessive memory when it processes malformed Thrift messages. An attacker can send such messages to cause a denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["armeria","java","package","self-hosted","thrift"],"not_affected_if":["no-thrift-endpoints"],"how_to_check":"- Check the Armeria version in the project's build file (for example `armeria` in Gradle or Maven) and see whether it is below `1.43.0`\n- Confirm whether the service exposes Thrift endpoints built with Armeria","fix":"- Armeria: move to `1.43.0` or later","status":"open","published_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:26+00:00","updated_at":"2026-11-06T08:42:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Armeria: move to `1.43.0` or later","reach":"network","title":"Armeria: malformed Thrift messages can exhaust memory and crash a service","impact":"low","summary":"Armeria, a Java library for building network services, allocates excessive memory when it processes malformed Thrift messages. An attacker can send such messages to cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","armeria","thrift","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"service crashes or stops responding under memory exhaustion","analyst_note":"","how_to_check":"- Check the Armeria version in the project's build file (for example `armeria` in Gradle or Maven) and see whether it is below `1.43.0`\n- Confirm whether the service exposes Thrift endpoints built with Armeria","plain_action":"","needs_analyst":false,"not_affected_if":["no-thrift-endpoints"],"who_is_affected":"Services built on Armeria that accept Thrift messages from clients are exposed; the sources do not say whether a default configuration is affected. Services that do not use Thrift endpoints can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4203,"output_tokens":456,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121824':14A,17A '-2026':13A,16A '1.43.0':64C 'alloc':33B,74C 'armeria':1A,18B,25B,60C 'attack':43B 'build':30B 'caus':49B,71C 'crash':9A 'cve':12A,15A 'denial':51B,78C 'excess':34B,72C 'exhaust':6A 'host':23B 'identifi':58C 'java':19B,27B 'librari':28B 'malform':2A,39B,67C 'memori':7A,35B,73C 'messag':4A,41B,47B,69C 'network':31B 'packag':20B 'potenti':75C 'prior':62C 'process':38B,66C 'result':76C 'self':22B 'self-host':21B 'send':45B 'servic':11A,32B,53B,80C 'thrift':3A,24B,40B,68C 'version':61C 'vulner':55C","nicknames":[],"mitigations":[],"who_affected":"Services built on Armeria that accept Thrift messages from clients are exposed; the sources do not say whether a default configuration is affected. Services that do not use Thrift endpoints can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armeria","high","java","package","selfhosted","thrift"],"campaign_type":null,"search_a":"'-121824':14A,17A '-2026':13A,16A 'armeria':1A 'crash':9A 'cve':12A,15A 'exhaust':6A 'malform':2A 'memori':7A 'messag':4A 'servic':11A 'thrift':3A","search_b":"'alloc':33B 'armeria':18B,25B 'attack':43B 'build':30B 'caus':49B 'denial':51B 'excess':34B 'host':23B 'java':19B,27B 'librari':28B 'malform':39B 'memori':35B 'messag':41B,47B 'network':31B 'packag':20B 'process':38B 'self':22B 'self-host':21B 'send':45B 'servic':32B,53B 'thrift':24B,40B","search_c":"'1.43.0':64C 'alloc':74C 'armeria':60C 'caus':71C 'denial':78C 'excess':72C 'identifi':58C 'malform':67C 'memori':73C 'messag':69C 'potenti':75C 'prior':62C 'process':66C 'result':76C 'servic':80C 'thrift':68C 'version':61C 'vulner':55C","first_public_at":"2026-11-06T07:16:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dl_cve@linecorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121824","severity":null,"published_at":"2026-11-06T08:17:20+00:00","modified_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[{"id":84764,"url":"https://github.com/line/armeria/security/advisories/GHSA-2pfv-5p52-crjm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T07:16:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}