PT-2021-3193 · Apache+2 · Apache Thrift+2

Published 2021-02-12 · Updated 2026-05-05 · CVE-2020-13949

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Thrift versions 0.9.3 through 0.13.0

Description Malicious RPC clients can send short messages that trigger a large memory allocation, potentially leading to a denial of service through uncontrolled resource consumption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2021-02888

BIT-THRIFT-2020-13949

CVE-2020-13949

GHSA-G2FG-MR77-6VRM

MGASA-2021-0578

OPENSUSE-SU-2024:11459-1

RHSA-2025:9582

Affected Products

Apache Thrift

Astra Linux

Debian

References · 263

• 🔥 https://lists.apache.org/thread.html/r02f7771863383ae993eb83cdfb70c3cb65a355c913242c850f61f1b8@%3Cissues.hbase.apache.org%3E · Exploit
• 🔥 https://lists.apache.org/thread.html/r7ae909438ff5a2ffed9211e6ab0bd926396fd0b1fc33f31a406ee704@%3Cissues.hbase.apache.org%3E · Exploit
• 🔥 https://lists.apache.org/thread.html/r812915ecfa541ad2ca65c68a97b2c014dc87141dfaefc4de85049681@%3Ccommits.camel.apache.org%3E · Exploit
• https://security.gentoo.org/glsa/202107-32 · Vendor Advisory
• https://lists.apache.org/thread.html/r43dc2b2e928e9d845b07ac075634cb759d91bb852421dc282f87a74a%40%3Cdev.thrift.apache.org%3E · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13949 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-13949 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13949 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11459-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g2fg-mr77-6vrm · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-13949 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0578 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://ubuntu.com/security/CVE-2020-13949 · Vendor Advisory