CVE-2026-58023: Apache Thrift Out-of-Bounds Vulnerability

CVE-2026-58023 Overview

CVE-2026-58023 is an out-of-bounds read vulnerability affecting the c_glib bindings of Apache Thrift. The issue impacts all versions of Apache Thrift prior to 0.24.0. The flaw is categorized under CWE-125 and can be triggered over the network without authentication or user interaction. An attacker who reaches a vulnerable Thrift service can cause the process to read memory beyond an allocated buffer, potentially exposing small amounts of process memory or destabilizing the service. Apache has released 0.24.0 to remediate the defect.

Critical Impact
Remote, unauthenticated attackers can trigger an out-of-bounds read in the Apache Thrift c_glib bindings, leading to information exposure or service disruption in RPC endpoints built on affected versions.

Affected Products

Apache Thrift versions prior to 0.24.0
Applications and services using the Apache Thrift c_glib bindings
Downstream projects that embed vulnerable Thrift C GLib client or server code

Discovery Timeline

2026-07-27 - CVE-2026-58023 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-58023

Vulnerability Analysis

Apache Thrift is a cross-language RPC framework that generates client and server stubs for structured data exchange. The c_glib bindings implement Thrift's protocol and transport layers in C on top of GLib. CVE-2026-58023 exists in the deserialization path within these bindings, where a boundary check is insufficient when parsing attacker-controlled protocol input. When a malformed Thrift message is processed, the code reads past the end of a buffer.

The vulnerability is reachable over the network on any endpoint that consumes Thrift traffic using the c_glib bindings. No authentication or user interaction is required. An attacker who crafts a malformed Thrift payload can force the vulnerable process to access memory outside the intended structure. Impact is limited to confidentiality and availability of the process handling the request; the flaw does not directly enable code execution.

Root Cause

The defect is a classic out-of-bounds read [CWE-125] in protocol parsing. Length or type fields carried inside the Thrift wire format are trusted without adequate validation against the actual buffer length before a read is performed. When the declared size exceeds the remaining bytes, the parser reads adjacent heap or stack memory.

Attack Vector

Exploitation requires sending a crafted Thrift RPC message to a service that uses the vulnerable c_glib bindings. The attacker controls protocol framing fields to force the parser to read beyond a buffer. Depending on service configuration, the malformed request may return an error, leak fragments of memory in an error response, or crash the worker process. No verified public proof-of-concept is available at the time of writing. Additional technical context is available in the Apache Mailing List Thread and the OpenWall OSS Security Post.

Detection Methods for CVE-2026-58023

Indicators of Compromise

Repeated Thrift protocol parsing errors or unexpected disconnects in application logs for services using the c_glib bindings.
Crash traces or core dumps referencing Thrift deserialization functions in the c_glib library.
Anomalous inbound traffic to Thrift service ports containing malformed frames or invalid type identifiers.

Detection Strategies

Inventory build artifacts, container images, and package manifests to identify services linked against Apache Thrift c_glib versions below 0.24.0.
Enable verbose protocol error logging on Thrift services to surface repeated malformed message events indicative of probing.
Deploy signatures on network security tooling to flag Thrift frames with length fields inconsistent with observed payload sizes.

Monitoring Recommendations

Monitor Thrift service processes for abnormal termination, elevated segfault rates, or spikes in error responses.
Track outbound response sizes on Thrift endpoints for anomalies that could indicate information leakage.
Correlate crash events with source IP addresses to identify attackers probing for the out-of-bounds read.

How to Mitigate CVE-2026-58023

Immediate Actions Required

Upgrade Apache Thrift to version 0.24.0 or later in all builds that use the c_glib bindings.
Rebuild and redeploy any application, container image, or package that statically or dynamically links the vulnerable Thrift C GLib library.
Restrict network exposure of Thrift RPC endpoints to trusted networks and authenticated clients until patching is complete.

Patch Information

Apache has fixed the issue in Apache Thrift 0.24.0. Refer to the Apache Thrift security advisory for the official announcement and to the additional Apache Mailing List Thread for discussion context. Rebuild all downstream software that bundles Thrift after upgrading, since header and library versions must match at compile time.

Workarounds

Place vulnerable Thrift services behind an authenticated reverse proxy or service mesh that validates message framing before forwarding.
Enforce strict maximum message size limits on Thrift transports to reduce the surface for malformed frames.
Where feasible, migrate affected services to another Thrift language binding until the c_glib-based service can be upgraded to 0.24.0.

bash

# Verify installed Apache Thrift version and confirm patched release
thrift -version

# Example: rebuild a c_glib-based project against Thrift 0.24.0
./configure --with-c_glib --without-cpp --without-java
make && make install