CVE-2026-83745
HighCVSS 8.7Summary
Vulnerability in Apache Thrift nodejs and D language bindings due to improper handling of length parameter, leading to excessive memory allocation. A small frame can cause allocation of up to 2 GiB. Affects versions before 0.25.0.
Risk Assessment
An attacker can exhaust server memory, causing denial of service. In Node.js, the connection remains open, allowing repeated attacks.
Recommendation
Upgrade Apache Thrift to version 0.25.0 or later.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-96289High
Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.
- CVE-2026-96287High
Apache Thrift Perl bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive CPU or memory consumption.
- CVE-2026-96286High
Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.
- CVE-2026-96277High
Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.
- CVE-2026-94658High
Apache Thrift Lua bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive resource consumption.
- CVE-2026-94657High
Apache Thrift JavaME bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94656High
Apache Thrift Ruby bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94655High
Apache Thrift Lua bindings before version 0.25.0 have allocation of resources without limits or throttling and inefficient algorithmic complexity vulnerabilities, which can lead to resource exhaustion and slowdown.
- CVE-2026-94654High
Infinite loop vulnerability in Apache Thrift Python bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
- CVE-2026-85476High
Infinite loop vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
Original NVD description (English source)
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS