CVE-2026-45112
HighCVSS 7.5Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
A vulnerability in Apache Thrift Java bindings from version 0.19.0 before 0.24.0 involves allocation of resources without limits or throttling, potentially leading to resource exhaustion (DoS).
Risk Assessment
An attacker can overwhelm the server by sending many requests, causing denial of service (DoS) and disrupting normal service operation.
Recommendation
Update Apache Thrift to version 0.24.0, which fixes this vulnerability.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-58662Critical
Improper validation of specified quantity in input and out-of-bounds read in Apache Thrift C++ bindings. Affects versions before 0.24.0.
- CVE-2026-58023Critical
A vulnerability in Apache Thrift c_glib bindings before version 0.24.0 causes an out-of-bounds read, potentially leading to data disclosure or crash.
- CVE-2026-55971Critical
Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.
- CVE-2026-48144Critical
Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.
- CVE-2026-66053Medium
A vulnerability in Apache Thrift Python bindings before version 0.24.0 involves improper validation of certificate with host mismatch, enabling man-in-the-middle attacks.
- CVE-2026-58389High
Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.
- CVE-2026-55970Medium
A vulnerability in Apache Thrift C++ bindings before version 0.24.0 causes a buffer over-read, potentially leading to data disclosure or crash.
- CVE-2026-55969High
Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.
- CVE-2026-55968High
Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.
- CVE-2026-49158High
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.