Resource Allocation Overflow Vulnerability in Apache Thrift by The Apache Software Foundation
CVE-2026-66331

6.9MEDIUM

Key Information:

Vendor

Apache
Status
Apache Thrift
Vendor
CVE Published:
2 October 2026

What is CVE-2026-66331?

A vulnerability exists in the buffered transport of the Delphi bindings for Apache Thrift, where resources may be allocated without appropriate limits or throttling mechanisms. This can potentially lead to resource exhaustion, making affected systems susceptible to performance degradation or denial of service. It is strongly advised for users to upgrade to version 0.25.0 or later to mitigate this issue effectively.

Affected Version(s)

Apache Thrift 0 < 0.25.0

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znz...
vendor-advisory
https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.