CVE-2026-55970: Apache Thrift Buffer Overflow Vulnerability

CVE-2026-55970 Overview

CVE-2026-55970 is a buffer over-read vulnerability [CWE-126] in the C++ bindings of Apache Thrift. The flaw affects all versions prior to 0.24.0 and can be triggered remotely over the network without authentication or user interaction. Apache Thrift is a cross-language Remote Procedure Call (RPC) framework used to build scalable services across languages, and the C++ bindings are widely deployed in server-side workloads.

An attacker who can reach an affected Thrift service can send crafted input that causes the parser to read beyond an allocated buffer. This exposes adjacent process memory and can leak sensitive data or destabilize the service.

Critical Impact
Remote, unauthenticated attackers can trigger out-of-bounds reads in Apache Thrift C++ services, leading to information disclosure and potential denial of service.

Affected Products

Apache Thrift C++ bindings, all versions before 0.24.0
Services built on Apache Thrift using the C++ runtime
Downstream projects embedding vulnerable Thrift C++ libraries

Discovery Timeline

2026-07-27 - CVE-2026-55970 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-55970

Vulnerability Analysis

The vulnerability is classified as a buffer over-read [CWE-126], a memory-safety flaw in which the software reads past the intended end of a buffer. In the Apache Thrift C++ bindings, deserialization logic processes length-prefixed fields received over the wire. When the parser trusts an attacker-supplied size or offset without bounding it against the actual buffer length, it accesses memory beyond the allocated region.

The consequence is limited-scope information disclosure and potential process instability. The CVSS 4.0 vector indicates the vulnerability is reachable over the network with low attack complexity, no privileges, and no user interaction. Impact is confined to low confidentiality and low availability effects on the vulnerable component.

Root Cause

The root cause lies in insufficient bounds validation inside the Thrift C++ deserialization path. Serialized Thrift messages carry length or count fields for strings, lists, maps, and binary blobs. When these values are consumed without cross-checking against the remaining buffer, the parser reads adjacent heap or stack memory. The upstream fix landed in Apache Thrift 0.24.0.

Attack Vector

An attacker sends a malformed Thrift message to any exposed C++ Thrift endpoint. Because Thrift is commonly deployed as an internal service bus, exposure often extends across microservice boundaries once an attacker has network reachability. Repeated malformed requests can be used to probe memory contents or crash worker threads. The vulnerability requires no credentials and no user interaction.

For full technical context, refer to the Apache Mailing List Thread, the Apache Mailing List Discussion, and the Openwall OSS-Security Update.

Detection Methods for CVE-2026-55970

Indicators of Compromise

Repeated malformed Thrift protocol frames arriving at C++ Thrift service ports, particularly with oversized length prefixes for strings, lists, or binary fields.
Unexpected worker-process crashes, segmentation faults, or restarts in services linking Apache Thrift C++ prior to 0.24.0.
Anomalous memory-region content appearing in application responses, logs, or error traces.

Detection Strategies

Inventory all services that link the Apache Thrift C++ runtime and identify versions below 0.24.0 via software composition analysis.
Deploy protocol-aware inspection on Thrift endpoints to flag frames where declared field lengths exceed frame size.
Correlate crash telemetry with inbound Thrift traffic to identify probing attempts.

Monitoring Recommendations

Monitor Thrift service logs for parser errors, truncated reads, and abnormal client disconnects.
Alert on spikes in RPC error rates or process restarts on services that expose Thrift endpoints.
Capture network flows to Thrift ports for retrospective analysis if exploitation is suspected.

How to Mitigate CVE-2026-55970

Immediate Actions Required

Upgrade Apache Thrift C++ bindings to version 0.24.0 or later across all affected services.
Rebuild and redeploy any statically linked binaries that embed the vulnerable Thrift runtime.
Restrict network exposure of Thrift endpoints to trusted internal networks and authenticated peers where possible.
Enable crash reporting and forward core-dump events to a central monitoring system to detect exploitation attempts.

Patch Information

Apache has released Apache Thrift 0.24.0, which fixes the buffer over-read in the C++ bindings. Upgrade guidance is provided in the Apache Mailing List Discussion. Package maintainers and distributions should pull the fixed release and rebuild dependent packages.

Workarounds

Place Thrift services behind a reverse proxy or service mesh that enforces mutual TLS and rejects untrusted clients until patching is complete.
Apply strict frame-size limits at the transport layer to reduce the surface for malformed length fields.
Isolate C++ Thrift workers in sandboxed containers with resource limits so crashes do not affect other workloads.

bash

# Verify installed Apache Thrift version and upgrade
thrift --version
# Example upgrade path using a package manager
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libthrift-dev thrift-compiler
# From source
wget https://downloads.apache.org/thrift/0.24.0/thrift-0.24.0.tar.gz
tar xzf thrift-0.24.0.tar.gz && cd thrift-0.24.0
./configure && make && sudo make install