CVE-2026-66837

Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.

Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.

Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.

NULL pointer dereference and use of uninitialized variable vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.

Vulnerability in the protocol skip routine in several Apache Thrift bindings that does not apply the recursion limit, allowing deep nesting of unknown fields to exhaust the stack. Affects Python C++ accelerator, PHP, Perl, Lua, Smalltalk, and OCaml libraries. Affects versions before 0.25.0.

Access of uninitialized pointer vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift C++ bindings (versions before 0.25.0) contain a missing release of memory after effective lifetime vulnerability. This can lead to gradual memory resource exhaustion.