Apache Thrift Java skip() lacks a recursion limit before 0.24.0
Original title: CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
CVE-2026-120135 is CVSS 8.2 and can crash Java services; upgrade libthrift to 0.24.0.
Apache Thrift Java bindings before 0.24.0 do not limit recursion depth by default in TProtocolUtil.skip(). The uncontrolled-recursion flaw is rated important, CVSS 4.0 8.2, with high availability impact and no confidentiality or integrity impact. Users of org.apache.thrift:libthrift are told to upgrade to 0.24.0. Yu Bao is credited.
Unconfirmed: The notice does not say whether the flaw is exploited.
- Affects Apache Thrift Java bindings before 0.24.0.
- Artifact named is org.apache.thrift:libthrift.
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N.
- Fixed version stated is 0.24.0.
- Posted by Jens Geyer on October 30.
Impact: Remote denial of service via uncontrolled recursion
| Product | Affected | Fixed in |
|---|---|---|
| Apache Thrift Java bindings (libthrift) | before 0.24.0 | 0.24.0 |
- 1.Upgrade org.apache.thrift:libthrift to 0.24.0.
- CVEs
- CVE-2026-120135
- Vendors
- Apache
- Products
- Apache Thriftlibthrift
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120135 | — | — | — |
From the original article
Posted by Jens Geyer on Oct 30 Severity: important CVSS 4. 0: 8. 2 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.