Threats Tagged 'ghsa-hfqq-j57v-2292'

CVE-2026-66858 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves uncontrolled recursion in the protocol skip routine of several Apache Thrift bindings, which do not enforce the binding's recursion limit. This can lead to stack exhaustion when processing deeply nested unknown fields. The affected components include the Python C++ accelerator, PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk, and OCaml libraries. The issue is fixed in Apache Thrift version 0.25.0.