CVE-2026-87117: Apache Thrift PHP Use After Free Vulnerability

CVE-2026-87117 Overview

CVE-2026-87117 is a NULL pointer dereference vulnerability [CWE-476] affecting the Apache Thrift PHP bindings in versions prior to 0.25.0. Apache Thrift is a widely deployed interface definition language and binary communication protocol used for cross-language remote procedure call (RPC) services. The flaw allows an unauthenticated remote attacker to trigger a crash in the PHP binding, resulting in denial of service against applications that process Thrift-formatted input. Apache has released version 0.25.0 to address the issue.

Critical Impact
Remote unauthenticated attackers can send crafted Thrift input to PHP services, causing a NULL pointer dereference and process termination. This disrupts availability of RPC endpoints and services dependent on Apache Thrift.

Affected Products

Apache Thrift PHP bindings versions prior to 0.25.0
PHP applications and services using Apache Thrift for RPC communication
Downstream software bundling vulnerable Thrift PHP libraries

Discovery Timeline

2026-10-02 - CVE CVE-2026-87117 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-87117

Vulnerability Analysis

The vulnerability resides in the Apache Thrift PHP bindings, which deserialize and process Thrift protocol messages exchanged between clients and servers. A NULL pointer dereference occurs when the PHP binding handles specific input that fails to populate an expected object or structure reference. The PHP runtime then dereferences a null value during subsequent processing, terminating execution of the request handler.

Because the attack vector is network-based and requires neither authentication nor user interaction, any PHP endpoint accepting Thrift traffic from untrusted sources is exposed. The impact is limited to availability; the condition does not permit code execution or data disclosure. Repeated exploitation can keep RPC services continuously unavailable, degrading dependent application tiers.

Root Cause

The root cause is missing validation of a pointer or object reference before use within the Thrift PHP binding deserialization or message-handling path. When input does not conform to assumptions about field presence or structure, the binding proceeds to access a NULL reference instead of rejecting the input gracefully. This matches the Common Weakness Enumeration pattern CWE-476 (NULL Pointer Dereference).

Attack Vector

An attacker sends a crafted Thrift message over the network to a PHP service that uses the Thrift PHP bindings. No authentication or user interaction is required. Processing the malformed input triggers the NULL pointer dereference, causing the PHP worker or request handler to crash. Service-level denial of service results, with impact scaling to the number of workers an attacker can exhaust.

No verified public exploit code is available at the time of publication. Refer to the Apache Mailing List Thread and the follow-up Apache Thrift Advisory Discussion for upstream details.

Detection Methods for CVE-2026-87117

Indicators of Compromise

Repeated PHP worker crashes, segmentation faults, or FastCGI process restarts coinciding with inbound Thrift traffic
Error log entries referencing Thrift deserialization functions or NULL reference access in PHP stack traces
Spikes in HTTP 5xx responses or RPC timeouts from services fronting Apache Thrift PHP endpoints

Detection Strategies

Inventory PHP applications and dependencies to identify any use of Apache Thrift PHP bindings below version 0.25.0
Monitor service availability metrics for anomalous restart patterns on PHP-FPM, Apache, or Nginx workers handling Thrift traffic
Inspect network traffic for malformed Thrift messages targeting known RPC ports and endpoints

Monitoring Recommendations

Enable verbose PHP error logging on Thrift endpoints and forward logs to a centralized SIEM for correlation
Alert on sustained increases in worker crash counts, request timeouts, or process respawn events
Track outbound alerts from web application firewalls or RPC gateways for unusual Thrift payload sizes or malformed frames

How to Mitigate CVE-2026-87117

Immediate Actions Required

Upgrade Apache Thrift PHP bindings to version 0.25.0 or later across all affected services
Identify all PHP services exposing Thrift endpoints to untrusted networks and prioritize them for patching
Restrict inbound access to Thrift RPC ports using network segmentation and firewall rules until patched

Patch Information

Apache has fixed the vulnerability in Apache Thrift 0.25.0. Users are recommended to upgrade to this version to remediate the NULL pointer dereference. Review the Apache Mailing List Thread for upstream advisory details and the Apache Thrift Advisory Discussion for additional context.

Workarounds

Place Thrift PHP endpoints behind an authenticated reverse proxy to limit exposure to anonymous attackers
Deploy input validation at an API gateway to reject malformed Thrift frames before they reach PHP workers
Rate-limit connections to Thrift endpoints to reduce the impact of repeated crash attempts

bash

# Upgrade Apache Thrift PHP bindings via Composer
composer require apache/thrift:^0.25.0

# Verify installed version
composer show apache/thrift | grep versions