Riskcovery

CVE-2026-43871

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

State
Published
Severity
8.7 High
Published
Jul 27, 2026
Updated
Jul 27, 2026
Reserved
May 4, 2026

Read the record on cve.org

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Napache

Weaknesses

  • CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Products

ProductVersions
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.