CVE-2026-83632: Apache Thrift Buffer Overflow Vulnerability

CVE-2026-83632 Overview

CVE-2026-83632 is a vulnerability in Apache Thrift affecting all versions prior to 0.25.0. The flaw combines three weaknesses: allocation of resources without limits or throttling, integer overflow or wraparound, and a heap-based buffer overflow [CWE-122]. An unauthenticated remote attacker can send crafted Thrift protocol messages that trigger integer wraparound during buffer sizing, leading to an undersized heap allocation and subsequent out-of-bounds write. The Apache Thrift project recommends upgrading to version 0.25.0, which contains the fix.

Critical Impact
Remote attackers can corrupt heap memory in Apache Thrift services before 0.25.0, enabling denial of service and potential remote code execution against RPC endpoints.

Affected Products

Apache Thrift versions before 0.25.0
Services and applications embedding vulnerable Thrift runtime libraries
RPC endpoints exposed over network transports using affected Thrift builds

Discovery Timeline

2026-10-02 - CVE-2026-83632 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-83632

Vulnerability Analysis

Apache Thrift is a cross-language RPC framework that serializes structured data using compact binary protocols. The vulnerability resides in message deserialization logic that reads length prefixes from untrusted input. An attacker sends a message declaring an attacker-controlled container, string, or binary field size. The size value interacts with internal arithmetic, producing an integer wraparound that undersizes a heap buffer. Subsequent copy operations write past the allocation boundary, corrupting adjacent heap metadata and application objects. The absence of resource limits amplifies the issue by allowing extreme size declarations to reach the vulnerable arithmetic path.

Root Cause

The root cause chains three defects. Thrift accepts length and element-count fields from the wire without upper-bound validation against available resources. Internal size calculations multiply or add these untrusted values, producing integer overflow when operands exceed native integer width. The computed, wrapped size is then passed to a heap allocator, producing a buffer smaller than the data about to be written. Downstream code copies attacker-supplied bytes into this undersized buffer, producing a classic heap-based buffer overflow [CWE-122].

Attack Vector

Exploitation requires network access to a service that deserializes Thrift messages. No authentication or user interaction is required. The attacker crafts a Thrift payload with specifically chosen field sizes that trigger the arithmetic wraparound, then transmits it over the Thrift transport. See the Apache Security Mailing List Thread and the Apache Security Discussion Thread for coordination details. No public proof-of-concept exploit is referenced in the advisory.

Detection Methods for CVE-2026-83632

Indicators of Compromise

Unexpected crashes, segmentation faults, or abort signals in processes hosting Thrift services
Thrift server logs showing malformed messages, oversized field declarations, or protocol errors from untrusted peers
Anomalous outbound connections or child process creation originating from Thrift service accounts

Detection Strategies

Inventory running services for Apache Thrift library versions below 0.25.0 using software composition analysis
Inspect network traffic to Thrift endpoints for messages declaring unusually large container, string, or binary lengths
Correlate process crash telemetry on hosts running Thrift services with inbound RPC traffic patterns

Monitoring Recommendations

Enable crash reporting and core-dump collection for Thrift server processes to detect heap corruption attempts
Alert on repeated protocol-level deserialization errors from the same source address
Monitor memory and CPU consumption on Thrift servers for spikes consistent with resource-exhaustion probing

How to Mitigate CVE-2026-83632

Immediate Actions Required

Upgrade Apache Thrift to version 0.25.0 or later in all affected applications and redeploy
Rebuild and release downstream software that statically links or vendors Thrift runtime code
Restrict network reachability of Thrift endpoints to trusted peers using firewalls or service mesh policies
Audit application logs for prior deserialization errors that may indicate exploitation attempts

Patch Information

The Apache Thrift project fixed this issue in version 0.25.0. Users are recommended to upgrade to 0.25.0 across all language bindings in use. Refer to the Apache Security Mailing List Thread for the official announcement and version guidance.

Workarounds

Terminate Thrift traffic at a reverse proxy that enforces maximum message size limits before messages reach vulnerable parsers
Require mutual TLS authentication on Thrift transports to prevent unauthenticated attackers from reaching the vulnerable code path
Isolate Thrift services in network segments and apply strict allowlists for client source addresses until patching is complete

bash

# Configuration example: verify installed Thrift version and upgrade
pip show thrift | grep -i version
pip install --upgrade "thrift>=0.25.0"

# For Maven-based projects, pin the dependency to the fixed release
# <dependency>
#   <groupId>org.apache.thrift</groupId>
#   <artifactId>libthrift</artifactId>
#   <version>0.25.0</version>
# </dependency>