CVE-2026-43871: Apache Thrift DOS Vulnerability

CVE-2026-43871 Overview

CVE-2026-43871 is an infinite loop vulnerability [CWE-835] affecting Apache Thrift language bindings for Python, Go, PHP, and Java. The flaw exists in all Apache Thrift versions prior to 0.24.0. A remote attacker can send malformed input over the network to trigger a loop with an unreachable exit condition, exhausting CPU and causing denial of service. The Apache Software Foundation released version 0.24.0 to fix the issue.

Critical Impact
Unauthenticated remote attackers can trigger sustained CPU exhaustion on Thrift-based services, disrupting availability of RPC endpoints across Python, Go, PHP, and Java implementations.

Affected Products

Apache Thrift Python bindings before 0.24.0
Apache Thrift Go, PHP, and Java bindings before 0.24.0
Any downstream application embedding vulnerable Thrift client or server libraries

Discovery Timeline

2026-07-27 - CVE-2026-43871 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-43871

Vulnerability Analysis

Apache Thrift provides a cross-language RPC framework with generated client and server bindings. The affected bindings contain a parsing path where a loop lacks a reachable exit condition when processing specifically crafted protocol messages. When a Thrift server or client deserializes the malicious payload, the loop iterates indefinitely and consumes CPU without returning to the caller.

The vulnerability requires no authentication and no user interaction. An attacker who can reach a Thrift endpoint over the network can trigger the condition by sending a single malformed message. Because the same defect appears across four bindings, services in mixed-language environments remain exposed even when only one component is upgraded.

CWE-835 (Loop with Unreachable Exit Condition) describes the underlying weakness. The impact is limited to availability: no memory corruption, information disclosure, or code execution is reported.

Root Cause

The Thrift protocol parsers in Python, Go, PHP, and Java iterate over structured fields, containers, or framed message boundaries returned by the transport layer. The loop termination check does not correctly account for edge cases in the serialized input, allowing an attacker-controlled value to keep the exit condition perpetually false. See the Apache Security Mailing List Discussion for the maintainers' notes.

Attack Vector

An attacker submits a crafted Thrift message to any exposed service using a vulnerable binding. The message parses without error but drives the deserialization loop into a non-terminating state. Repeated requests amplify the effect and exhaust worker threads or process CPU quotas. Additional context is available in the Openwall OSS-Security Archive Post.

No public proof-of-concept exploit or exploitation activity has been reported. The current EPSS probability is approximately 1.07% (percentile 61.6).

Detection Methods for CVE-2026-43871

Indicators of Compromise

Sustained 100% CPU utilization on one or more Thrift worker threads following a specific inbound request
Thrift service latency spikes or timeouts across dependent microservices without an increase in normal request volume
Repeated small inbound Thrift requests from a single source address that correlate with worker-thread stalls

Detection Strategies

Instrument Thrift servers with per-request processing-time metrics and alert when deserialization time exceeds a defined threshold
Inspect application logs for stalled request IDs that never emit a completion or error entry
Baseline CPU usage per Thrift service and alert on sustained deviations that align with inbound traffic from untrusted networks

Monitoring Recommendations

Track the deployed Thrift library version across Python, Go, PHP, and Java services and flag any instance below 0.24.0
Monitor network flows to Thrift ports for anomalous request-to-response ratios that indicate hung parsing
Correlate Thrift service health metrics with source IP telemetry to identify attackers repeatedly triggering the loop

How to Mitigate CVE-2026-43871

Immediate Actions Required

Upgrade all Apache Thrift bindings for Python, Go, PHP, and Java to version 0.24.0 or later
Inventory downstream applications and container images that bundle Thrift libraries and rebuild them against the fixed release
Restrict network exposure of Thrift endpoints to trusted networks or authenticated peers until patching completes

Patch Information

The Apache Software Foundation released Apache Thrift 0.24.0, which resolves the infinite loop condition in the affected language bindings. Refer to the Apache Security Mailing List Thread for the official announcement and to the vendor advisory for upgrade guidance.

Workarounds

Place a reverse proxy or API gateway in front of Thrift services and enforce strict request timeouts to bound the impact of stalled parsers
Apply per-connection CPU and request-rate limits to reduce the amplification potential of a single malicious client
Terminate long-running Thrift worker threads that exceed a maximum processing duration and recycle the process

bash

# Example: enforce a per-request timeout at the reverse proxy layer
# (illustrative nginx stream block in front of a Thrift TCP service)
stream {
    upstream thrift_backend {
        server 10.0.0.10:9090;
    }
    server {
        listen 9090;
        proxy_pass thrift_backend;
        proxy_connect_timeout 5s;
        proxy_timeout 15s;
    }
}