CVE-2026-45112 Overview
CVE-2026-45112 is an Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] affecting the Apache Thrift Java bindings. The flaw allows a remote, unauthenticated attacker to send crafted messages to a Thrift server, triggering unbounded resource allocation on the receiving side. Successful exploitation degrades availability of services that use the affected library. The issue affects Apache Thrift versions from 0.19.0 up to but not including 0.24.0. The Apache Software Foundation recommends upgrading to version 0.24.0, which fixes the issue.
Critical Impact
A remote, unauthenticated attacker can exhaust memory or processing resources on any service using Apache Thrift Java bindings between 0.19.0 and 0.23.x, causing denial of service.
Affected Products
- Apache Thrift Java bindings 0.19.0 through 0.23.x
- Java applications and services embedding vulnerable Thrift library versions
- Downstream frameworks and RPC services depending on Apache Thrift Java
Discovery Timeline
- 2026-07-27 - CVE-2026-45112 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-45112
Vulnerability Analysis
Apache Thrift is a cross-language RPC framework that serializes structured data over binary or compact protocols. The Java bindings deserialize incoming message headers and fields, allocating buffers based on length values supplied by the peer. In affected versions, the deserialization path does not enforce upper bounds on those allocations, allowing a small crafted message to request very large in-memory structures.
The vulnerability is reachable over the network without authentication or user interaction. Impact is limited to availability of the receiving service. Neither confidentiality nor integrity of the process is affected. EPSS data indicates a probability of 1.94% at the 78th percentile at the time of publication.
Root Cause
The root cause is missing input validation on size fields inside Thrift-encoded messages. When the Java transport layer reads a declared list, map, set, or string length, it uses that value to allocate memory or iterate structures without cross-checking against the actual remaining bytes in the frame or against a configured maximum. A hostile peer can therefore claim an enormous element count in a few bytes, forcing the server to attempt an allocation orders of magnitude larger than the wire payload.
Attack Vector
Exploitation requires only network access to an endpoint that accepts Thrift protocol traffic using the Java bindings. An attacker sends one or more small Thrift messages with inflated length fields. The server allocates the requested capacity, causing memory pressure, garbage collection pauses, or OutOfMemoryError. Repeating the request across connections amplifies the effect and can take a service offline. No credentials, prior access, or user action are needed.
No public proof-of-concept exploit code is currently available for CVE-2026-45112. Technical discussion is available in the Apache Mailing List Thread and the Openwall OSS Security Update.
Detection Methods for CVE-2026-45112
Indicators of Compromise
- Sudden java.lang.OutOfMemoryError events or extended garbage collection pauses in JVMs hosting Thrift services
- Small inbound Thrift frames followed by disproportionate heap growth or CPU spikes on the server
- Repeated short-lived TCP connections to Thrift ports terminating after minimal data exchange
- Application logs from TBinaryProtocol or TCompactProtocol showing large declared container or string sizes
Detection Strategies
- Inventory Java applications and identify those bundling libthrift between versions 0.19.0 and 0.23.x using software composition analysis.
- Instrument Thrift server code to log message size, declared field lengths, and container element counts for anomaly analysis.
- Correlate JVM memory telemetry with network flow data to spot allocation spikes tied to low-volume inbound Thrift traffic.
Monitoring Recommendations
- Alert on heap utilization crossing service-specific thresholds along with elevated allocation rates on Thrift listeners.
- Track connection churn and error rates on Thrift ports to detect probing or amplified DoS attempts.
- Forward JVM crash dumps and Thrift protocol exceptions to a centralized log platform for retrospective analysis.
How to Mitigate CVE-2026-45112
Immediate Actions Required
- Upgrade all Java applications and services to Apache Thrift version 0.24.0 or later.
- Enumerate transitive dependencies to locate embedded copies of libthrift in build artifacts and container images.
- Restrict network exposure of Thrift endpoints to trusted clients using firewall rules or service mesh policies until patches are applied.
Patch Information
Apache Thrift 0.24.0 remediates CVE-2026-45112 by enforcing bounds on resource allocation during deserialization in the Java bindings. Consult the official Apache Mailing List Discussion for the release announcement and remediation guidance. Rebuild and redeploy all downstream artifacts that shade or bundle the vulnerable library.
Workarounds
- Place Thrift services behind an authenticating reverse proxy or mutual TLS gateway to prevent unauthenticated peers from sending arbitrary frames.
- Apply request-size limits at the transport layer by wrapping TFramedTransport with a maximum frame size appropriate to your workload.
- Set conservative JVM heap sizes and enable rapid process restart under supervision to contain the impact of allocation attacks until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
