CVE-2026-66837: Apache Thrift PHP Buffer Overflow Vulnerability

CVE-2026-66837 Overview

CVE-2026-66837 is a stack-based buffer overflow combined with an integer overflow or wraparound condition in the PHP bindings of Apache Thrift. The flaw affects all Apache Thrift releases prior to version 0.25.0. Apache Thrift is a widely deployed cross-language serialization and RPC framework, and the PHP bindings are commonly used in web backends that exchange Thrift-encoded messages over the network. A remote, unauthenticated attacker can send crafted Thrift payloads to trigger the overflow condition and disrupt availability of the affected service. The Apache Thrift project has published a fixed release and recommends upgrading to 0.25.0.

Critical Impact
Remote, unauthenticated attackers can trigger a stack-based buffer overflow in Apache Thrift PHP bindings, impacting availability of applications that deserialize untrusted Thrift input.

Affected Products

Apache Thrift PHP bindings, all versions before 0.25.0
Applications and services embedding the Apache Thrift PHP library for RPC or serialization
Downstream PHP packages and frameworks that depend on vulnerable Apache Thrift PHP builds

Discovery Timeline

2026-10-02 - CVE-2026-66837 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-66837

Vulnerability Analysis

The vulnerability combines two memory safety weaknesses in the Apache Thrift PHP bindings. An integer overflow or wraparound occurs during size or length computation when parsing Thrift-encoded input. The resulting miscalculated length is then used in a stack-allocated buffer operation, producing a stack-based buffer overflow classified as [CWE-121]. Because Thrift PHP bindings typically process serialized data arriving from external clients, an attacker can reach the vulnerable code path over the network without authentication. Successful exploitation corrupts stack memory and causes the PHP process handling the request to crash, impacting the availability of services relying on the bindings.

Root Cause

The root cause is unchecked arithmetic on attacker-controlled size fields within the Thrift PHP deserialization logic. When a crafted length value wraps around native integer bounds, subsequent allocation or copy operations use the wrapped value instead of the original. Data is then written past the intended stack buffer boundary, overwriting adjacent stack memory such as saved frame pointers and return addresses.

Attack Vector

Exploitation requires only the ability to send a Thrift-encoded message to the vulnerable application. No credentials, user interaction, or prior access are needed. An attacker crafts a Thrift payload with manipulated size fields that trigger the integer overflow during parsing. The malformed message drives the PHP binding into the vulnerable copy routine, where stack memory corruption occurs. The practical impact observed in the CVSS vector is high availability loss, consistent with process crashes rather than confirmed code execution.

No verified exploit code is published. See the Apache Thrift mailing list discussions (Apache Thread Discussion 1 and Apache Thread Discussion 2) for the project's technical notes.

Detection Methods for CVE-2026-66837

Indicators of Compromise

Repeated PHP worker crashes, segmentation faults, or FastCGI process restarts correlated with incoming Thrift traffic.
Malformed Thrift messages in application logs containing unusually large list, set, map, or binary length fields.
Spikes in HTTP 5xx responses or dropped RPC connections on endpoints that deserialize Thrift payloads.

Detection Strategies

Inventory PHP applications and dependencies to identify any use of Apache Thrift PHP bindings below version 0.25.0.
Inspect Thrift traffic for length-prefixed fields that exceed realistic protocol limits for your application.
Alert on abnormal termination of PHP-FPM, Apache, or NGINX worker processes handling Thrift endpoints.

Monitoring Recommendations

Centralize PHP engine, web server, and application logs and monitor for crash signatures linked to Thrift deserialization.
Instrument Thrift RPC endpoints with request-size and schema validation metrics to surface anomalous payloads.
Track outbound alerting from WAF or API gateway components that inspect Thrift binary or compact protocol framing.

How to Mitigate CVE-2026-66837

Immediate Actions Required

Upgrade Apache Thrift PHP bindings to version 0.25.0 or later across all affected applications.
Identify every service exposing Thrift endpoints to untrusted networks and prioritize those for patching first.
Restrict network access to Thrift RPC listeners so that only trusted clients and internal services can reach them.

Patch Information

The Apache Thrift project fixed the issue in version 0.25.0. Upgrade the apache/thrift PHP package and regenerate any vendored Thrift PHP sources against the patched release. Review the Apache mailing list announcements (Apache Thread Discussion 1, Apache Thread Discussion 2) for release details and project guidance.

Workarounds

Place Thrift endpoints behind an authenticated reverse proxy or mutual TLS to block unauthenticated requests.
Enforce strict maximum message size limits at the network or application layer before Thrift parsing begins.
Disable or remove unused Thrift PHP services until the upgrade to 0.25.0 can be completed.

bash

# Configuration example: upgrade Apache Thrift PHP bindings via Composer
composer require apache/thrift:^0.25.0
composer update apache/thrift
php -r "echo Thrift\\Base\\TBase::class;" # sanity check that bindings load