CVE-2026-66081: Apache Thrift Use-After-Free Vulnerability

CVE-2026-66081 Overview

CVE-2026-66081 is an Access of Uninitialized Pointer vulnerability [CWE-824] in the Apache Thrift c_glib language bindings. The flaw affects all Apache Thrift releases prior to version 0.25.0. Apache Thrift is a widely used cross-language Remote Procedure Call (RPC) framework, and the c_glib bindings provide C integration via the GLib library. An attacker can trigger the issue remotely over the network without authentication or user interaction, leading to a loss of availability in services that process untrusted Thrift messages.

Critical Impact
Remote, unauthenticated attackers can crash services built on Apache Thrift c_glib bindings by sending crafted RPC messages that dereference an uninitialized pointer.

Affected Products

Apache Thrift versions prior to 0.25.0
Applications and services linking the Apache Thrift c_glib bindings
Downstream C-based RPC servers and clients built on Thrift

Discovery Timeline

2026-10-02 - CVE-2026-66081 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in the NVD database

Technical Details for CVE-2026-66081

Vulnerability Analysis

The vulnerability resides in the Apache Thrift c_glib bindings, which generate and run C code for serializing and deserializing Thrift protocol messages. The code accesses a pointer that has not been properly initialized before use. When a crafted message reaches the affected deserialization or dispatch path, the uninitialized pointer is read and dereferenced. This causes undefined behavior, with the most reliably reproducible outcome being a process crash and denial of service.

The weakness is classified as [CWE-824] Access of Uninitialized Pointer. The attack vector is network-based, requires no privileges, and needs no user interaction. The confidentiality and integrity impacts are rated none, while availability impact is high, consistent with a remote crash primitive against affected services.

Root Cause

The root cause is a code path in the c_glib bindings that uses a pointer variable before it has been assigned a valid value. Depending on the stack or heap state at runtime, the pointer may hold indeterminate data left over from prior allocations. Dereferencing this value produces a segmentation fault or, in less common scenarios, corrupts program state. The fix in Apache Thrift 0.25.0 ensures the affected pointers are initialized before any read.

Attack Vector

An attacker sends a crafted Thrift RPC payload to a service that uses the vulnerable c_glib bindings. The payload triggers the code path containing the uninitialized pointer. Because Thrift servers typically expose network listeners, the attack can be delivered remotely without authentication. Repeated exploitation can keep the target service unavailable. See the Apache Mailing List Discussion and the Apache Mailing List Thread for upstream discussion.

// No verified public exploit code is available.
// Refer to the Apache mailing list references for upstream details.

Detection Methods for CVE-2026-66081

Indicators of Compromise

Unexpected crashes, SIGSEGV signals, or core dumps in processes linking the Apache Thrift c_glib library.
Repeated short-lived connections to Thrift RPC ports followed by service restarts or supervisor-triggered respawns.
Malformed or truncated Thrift protocol frames logged by RPC servers prior to a crash.

Detection Strategies

Inventory applications that depend on Apache Thrift and identify those built against the c_glib bindings at versions below 0.25.0.
Monitor process exit codes and crash telemetry from services exposing Thrift endpoints, correlating with inbound network traffic.
Deploy protocol-aware parsers or Intrusion Detection System (IDS) rules that flag malformed Thrift messages targeting known RPC ports.

Monitoring Recommendations

Forward application crash events, systemd service restarts, and coredumpctl entries into a centralized logging or Security Information and Event Management (SIEM) platform.
Alert on anomalous restart frequency for Thrift-based services, which can indicate exploitation attempts.
Track egress and ingress on Thrift listener ports and baseline normal client behavior to spot crafted payload bursts.

How to Mitigate CVE-2026-66081

Immediate Actions Required

Upgrade Apache Thrift to version 0.25.0 or later across all affected build pipelines and runtime hosts.
Rebuild and redeploy any C or GLib applications that statically link or vendor the c_glib bindings.
Restrict network exposure of Thrift RPC endpoints to trusted clients using firewall rules or service mesh policies.

Patch Information

Apache Thrift 0.25.0 fixes the uninitialized pointer access in the c_glib bindings. Users are recommended to upgrade to this version. Review the Apache Mailing List Discussion and the Apache Mailing List Thread for the official announcement and change references.

Workarounds

Place Thrift services behind an authenticated reverse proxy or mutual Transport Layer Security (mTLS) gateway to limit who can send messages.
Enforce strict ingress Access Control Lists (ACLs) so only known upstream clients can reach Thrift RPC ports.
Where feasible, switch services to a non-c_glib Thrift binding until the upgrade to 0.25.0 is completed.

bash

# Verify installed Apache Thrift version
thrift --version

# Example iptables rule to restrict Thrift RPC port 9090 to a trusted subnet
iptables -A INPUT -p tcp --dport 9090 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9090 -j DROP