PT-2026-64878 · Apache · Apache Thrift

CVE-2026-43871 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0

Description An infinite loop issue exists in the Python, Go, PHP, and Java bindings of Apache Thrift. This occurs due to a loop with an unreachable exit condition within the TCompactProtocol varint byte-count limit.

Recommendations Upgrade to version 0.24.0.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-43871

Affected Products

Apache Thrift

References · 5

• https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby · Vendor Advisory
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43871 · Security Note
• https://t.me/CVEtracker/61322 · Telegram Post
• http://openwall.com/lists/oss-security/2026/07/24/33 · Note