CVE-2026-58389: Apache Thrift DOS Vulnerability

CVE-2026-58389 Overview

CVE-2026-58389 is a resource exhaustion vulnerability affecting the Apache Thrift Rust bindings. The flaw is classified under CWE-770, Allocation of Resources Without Limits or Throttling. Remote attackers can exploit this weakness over the network without authentication or user interaction to cause denial of service in applications built on the affected Rust bindings.

The issue affects all Apache Thrift releases prior to 0.24.0. Users are directed to upgrade to version 0.24.0, which contains the fix. See the Apache Mailing List advisory for vendor details.

Critical Impact
Unauthenticated remote attackers can trigger unbounded memory allocation in Apache Thrift Rust bindings, exhausting resources and disrupting service availability.

Affected Products

Apache Thrift Rust bindings, all versions before 0.24.0
Applications and services embedding the affected Rust crate
Downstream RPC servers deserializing untrusted Thrift-encoded input

Discovery Timeline

2026-07-27 - CVE-2026-58389 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-58389

Vulnerability Analysis

The Apache Thrift Rust bindings deserialize network-supplied messages without enforcing bounds on allocation sizes. When a peer sends a crafted protocol frame declaring a large container or field length, the Rust reader allocates memory or buffers to match the attacker-declared size before validating whether the corresponding payload exists.

This behavior maps directly to CWE-770: resources are allocated based on untrusted input without a throttling limit. The vulnerability sits inside the protocol decoding path, so any Rust service exposing a Thrift endpoint over TCP or HTTP is reachable by unauthenticated clients.

Successful exploitation exhausts process memory or CPU, forcing the affected service into failure states. The primary impact is on availability; confidentiality and integrity are not directly affected.

Root Cause

The Rust protocol readers accept size fields (list length, set length, map length, binary length, string length) from the wire and use them to pre-allocate storage. The bindings do not compare declared sizes against remaining input length or a configured maximum. A short attacker frame can therefore claim a large collection and drive allocation to arbitrary limits.

Attack Vector

An attacker connects to a Thrift server built with the vulnerable Rust bindings and sends a single crafted message advertising oversized field or container counts. No credentials, prior access, or user interaction are required. Repeating the request or opening parallel connections compounds memory pressure and accelerates service failure.

See the Openwall OSS Security discussion and the Apache mailing list thread for background on the disclosure.

Detection Methods for CVE-2026-58389

Indicators of Compromise

Sudden spikes in resident memory consumption on processes hosting Thrift Rust services
Repeated OOM-killer terminations or panics originating from Thrift decoder frames
Short inbound messages followed by unusually large internal allocations
Client connections that disconnect immediately after sending a single small frame

Detection Strategies

Instrument Thrift servers to log declared container and binary lengths, then alert on values that exceed realistic protocol limits
Correlate process memory growth with inbound Thrift traffic volume to identify amplification patterns
Deploy network-layer inspection to flag Thrift frames whose declared sizes are inconsistent with payload length

Monitoring Recommendations

Track per-process memory and file descriptor metrics for services using apache:thrift Rust bindings
Enable structured logging on RPC boundaries to capture peer IP, frame size, and decoder errors
Alert on repeated decoder panics or truncated-frame errors from the same source address

How to Mitigate CVE-2026-58389

Immediate Actions Required

Upgrade the thrift Rust crate dependency to version 0.24.0 and rebuild affected services
Inventory all internal and external services that link the Apache Thrift Rust bindings
Restrict network exposure of Thrift endpoints to trusted peers until patching is complete
Add rate limiting and connection quotas at the load balancer or service mesh layer

Patch Information

Apache Thrift 0.24.0 fixes the unbounded allocation behavior in the Rust bindings. Consult the Apache Thrift security advisory for the authoritative fix reference and rebuild any binaries that statically link the affected crate.

Workarounds

Terminate Thrift traffic behind a proxy that enforces maximum message size before decoding
Apply operating system resource limits (ulimit, cgroup memory caps) to Thrift server processes
Require mutual TLS or network ACLs so only authenticated peers can reach Thrift endpoints
Monitor for and drop connections that submit malformed or oversized protocol headers

bash

# Update the Rust dependency to the fixed release
cargo update -p thrift --precise 0.24.0
cargo build --release

# Enforce a per-process memory ceiling via systemd for defense-in-depth
# /etc/systemd/system/thrift-service.d/override.conf
# [Service]
# MemoryMax=2G
# TasksMax=512
systemctl daemon-reload && systemctl restart thrift-service