Threats Tagged 'ghsa-rvwr-5g7j-6pm8'

CVE-2026-83663 is an uncontrolled recursion vulnerability in the Go bindings of Apache Thrift before version 0.25.0. The issue arises because the Go transports read frames recursively when encountering frames with no payload bytes, leading to unbounded recursion depth. This causes the Go runtime stack limit to be exceeded, resulting in a fatal error that terminates the entire process. The vulnerability has a high severity with a CVSS score of 8.7. Users are advised to upgrade to Apache Thrift version 0.25.0, which contains the fix.