CVE-2026-58662: Apache Thrift Input Validation Vulnerability

CVE-2026-58662 Overview

CVE-2026-58662 is an out-of-bounds read vulnerability in the Apache Thrift C++ bindings caused by improper validation of specified quantity in input [CWE-125]. The flaw affects all versions of Apache Thrift prior to 0.24.0. A remote attacker can send a crafted Thrift message that triggers the C++ deserializer to read memory beyond the intended buffer boundaries. The result is a denial-of-service condition against services that expose Thrift endpoints over the network. Apache has released 0.24.0 to address the issue.

Critical Impact
Unauthenticated network attackers can crash Apache Thrift C++ services by sending malformed messages that trigger out-of-bounds memory reads.

Affected Products

Apache Thrift C++ bindings, all versions before 0.24.0
Applications and services that link against vulnerable Apache Thrift C++ libraries
Downstream distributions packaging Apache Thrift prior to 0.24.0

Discovery Timeline

2026-07-27 - CVE-2026-58662 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-58662

Vulnerability Analysis

The vulnerability resides in the Apache Thrift C++ bindings, which implement serialization and remote procedure call (RPC) primitives for services written in C++. Thrift messages encode field types and length prefixes that the deserializer uses to walk incoming byte streams. When a length or quantity value inside an inbound message is not validated against the actual size of the remaining buffer, the C++ deserializer reads memory past the end of the allocated region.

The reachable code path processes attacker-supplied length metadata without a bounds check, producing an out-of-bounds read [CWE-125]. The primary security consequence is availability loss: the affected process typically terminates when the read touches unmapped memory or triggers an assertion. Because Thrift is commonly deployed as a network-facing RPC layer, a single malformed request can disrupt production services. The CVSS vector indicates network reachability, no authentication, and no user interaction required.

Root Cause

The root cause is missing validation of a length or count field in a serialized Thrift message. The C++ decoder trusts the specified quantity from untrusted input and issues a read of that size against the internal buffer. Without comparing the declared length to the remaining input, the code walks off the end of the buffer.

Attack Vector

Exploitation requires only network access to a service that uses Apache Thrift C++ bindings to deserialize inbound messages. The attacker crafts a Thrift payload containing an oversized length field for a variable-length structure such as a string, binary, list, set, or map. Sending the payload to the RPC endpoint causes the service to invoke the vulnerable decoder path and read past the buffer boundary.

No verified exploit code has been published. See the Apache Mailing List Discussion and Openwall OSS Security Announcement for the vendor description of the affected code path.

Detection Methods for CVE-2026-58662

Indicators of Compromise

Repeated crashes, segmentation faults, or abnormal restarts of processes that link Apache Thrift C++ libraries older than 0.24.0
Malformed Thrift frames on RPC ports containing length prefixes that exceed the size of the transported payload
Sudden spikes in TCP resets or connection terminations from Thrift service endpoints

Detection Strategies

Inventory binaries and containers that link libthrift C++ builds and compare their versions against 0.24.0
Inspect application and crash logs for stack traces originating in Thrift protocol decoder functions such as readString, readBinary, readListBegin, or readMapBegin
Deploy network sensors that parse Thrift binary and compact protocols to flag frames whose declared field lengths do not match the observed frame size

Monitoring Recommendations

Alert on service watchdog restarts and core dumps for any process using Apache Thrift C++ bindings
Monitor RPC endpoints for anomalous request sizes and malformed protocol headers
Track outbound reachability of Thrift services from untrusted networks and treat unauthenticated exposure as high priority

How to Mitigate CVE-2026-58662

Immediate Actions Required

Upgrade Apache Thrift to 0.24.0 or later across all C++ producers and consumers
Rebuild and redeploy any statically linked application that embeds the vulnerable Thrift C++ library
Restrict network access to Thrift RPC ports so that only authenticated internal clients can reach them
Enable process supervisors and crash reporting to detect exploitation attempts against services that cannot be patched immediately

Patch Information

Apache has released Apache Thrift 0.24.0, which fixes the improper input validation in the C++ bindings. Refer to the Apache Mailing List Discussion and the Apache Mailing List Update for the official announcement. Package maintainers should rebuild dependent artifacts against the fixed version.

Workarounds

Place Thrift services behind an authenticating reverse proxy or service mesh that terminates untrusted traffic before it reaches the vulnerable decoder
Enforce maximum message and frame size limits at the transport layer to reduce the impact of malformed length fields
Isolate Thrift C++ services on network segments that are unreachable from untrusted sources until upgrades are complete

bash

# Verify installed Apache Thrift version and upgrade
thrift --version
# Expected after remediation: Thrift version 0.24.0 (or later)

# Example: rebuild against fixed release from source
curl -O https://downloads.apache.org/thrift/0.24.0/thrift-0.24.0.tar.gz
tar xzf thrift-0.24.0.tar.gz
cd thrift-0.24.0
./configure --with-cpp --without-python --without-java
make && sudo make install