This vulnerability in Apache Thrift (CVE-2026-43871) is classified as CWE-835, indicating a loop with an unreachable exit condition, effectively causing an infinite loop. It affects multiple language bindings including Python, Go, PHP, and Java. The affected versions are all releases prior to 0.24.0. The vulnerability has a CVSS 4.0 base score of 8.7, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. The vendor has fixed the issue in Apache Thrift version 0.24.0.

The vulnerability can cause an infinite loop in affected Apache Thrift bindings, potentially leading to denial of service by exhausting resources or causing the application to hang. The CVSS score of 8.7 indicates a high impact on availability with no required privileges or user interaction for exploitation.

Users should upgrade Apache Thrift to version 0.24.0 or later, as this version contains the fix for the infinite loop vulnerability. No other mitigation or temporary workaround is indicated in the available data.