CVE-2026-66858: CWE-674 Uncontrolled Recursion in Apache Software Foundation Apache Thrift
CVE-2026-66858 is a high-severity vulnerability in Apache Thrift before version 0.25.0. The issue arises because the protocol skip routine in several Apache Thrift bindings does not enforce the binding's recursion limit, allowing deeply nested unknown fields in a message to exhaust the stack. This affects the Python C++ accelerator, PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk, and OCaml libraries. The vulnerability is fixed in Apache Thrift version 0.25.0.
AI Analysis
Technical Summary
The vulnerability CVE-2026-66858 in Apache Thrift involves uncontrolled recursion in the protocol skip routine of several language bindings. The routine fails to apply the recursion limit, which can lead to stack exhaustion when processing messages with deeply nested unknown fields. Affected bindings include the Python C++ accelerator, PHP library and thrift_protocol extension, Perl, Lua, Smalltalk, and OCaml libraries. The issue is resolved in Apache Thrift version 0.25.0.
Potential Impact
An attacker can craft a message with deeply nested unknown fields that causes the affected Apache Thrift bindings to exhaust the stack, potentially leading to denial of service due to application crashes or resource exhaustion. The vulnerability does not require privileges or user interaction and can be triggered remotely over the network.
Mitigation Recommendations
Users should upgrade Apache Thrift to version 0.25.0 or later, where this vulnerability is fixed. No other mitigations are indicated or necessary as the fix is official and available.
CVE-2026-66858: CWE-674 Uncontrolled Recursion in Apache Software Foundation Apache Thrift
Description
CVE-2026-66858 is a high-severity vulnerability in Apache Thrift before version 0.25.0. The issue arises because the protocol skip routine in several Apache Thrift bindings does not enforce the binding's recursion limit, allowing deeply nested unknown fields in a message to exhaust the stack. This affects the Python C++ accelerator, PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk, and OCaml libraries. The vulnerability is fixed in Apache Thrift version 0.25.0.
CVSS v4.0
Score 8.7high
Affected software
Apache Software Foundation
Apache Thrift
Apache Software Foundation
Apache Thrift
Apache Software Foundation
Apache Thrift
Apache Software Foundation
Apache Thrift
Apache Software Foundation
Apache Thrift
Apache Software Foundation
Apache Thrift
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-66858 in Apache Thrift involves uncontrolled recursion in the protocol skip routine of several language bindings. The routine fails to apply the recursion limit, which can lead to stack exhaustion when processing messages with deeply nested unknown fields. Affected bindings include the Python C++ accelerator, PHP library and thrift_protocol extension, Perl, Lua, Smalltalk, and OCaml libraries. The issue is resolved in Apache Thrift version 0.25.0.
Potential Impact
An attacker can craft a message with deeply nested unknown fields that causes the affected Apache Thrift bindings to exhaust the stack, potentially leading to denial of service due to application crashes or resource exhaustion. The vulnerability does not require privileges or user interaction and can be triggered remotely over the network.
Mitigation Recommendations
Users should upgrade Apache Thrift to version 0.25.0 or later, where this vulnerability is fixed. No other mitigations are indicated or necessary as the fix is official and available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-27T22:27:11.611Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abfab3ca43b0b3b89bc8cf8
Added to database: 10/02/2026, 13:01:48 UTC
Last enriched: 10/02/2026, 13:16:17 UTC
Last updated: 10/02/2026, 13:27:38 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.