CVE-2026-93925: Apache Thrift Buffer Overflow Vulnerability

CVE-2026-93925 Overview

CVE-2026-93925 is a stack-based buffer overflow combined with an incorrect bitwise shift of an integer in the Apache Thrift C++ THeaderProtocol implementation. The flaw affects all Apache Thrift C++ releases before 0.25.0. A remote, unauthenticated attacker can send crafted protocol frames over the network to corrupt stack memory inside a Thrift server or client. The resulting condition primarily impacts process availability, causing the Thrift endpoint to crash. The Apache Thrift project recommends upgrading to version 0.25.0, which contains the fix.

Critical Impact
Unauthenticated network attackers can crash Apache Thrift C++ services parsing THeaderProtocol messages, disrupting any application that embeds the vulnerable library.

Affected Products

Apache Thrift C++ library versions prior to 0.25.0
Applications and services linking the vulnerable THeaderProtocol implementation
Downstream distributions packaging Apache Thrift C++ builds below 0.25.0

Discovery Timeline

2026-10-02 - CVE-2026-93925 published to the National Vulnerability Database
2026-10-02 - Record last modified in NVD

Technical Details for CVE-2026-93925

Vulnerability Analysis

The vulnerability resides in the C++ implementation of THeaderProtocol, Apache Thrift's framed protocol that carries metadata headers alongside serialized payloads. The parser performs an incorrect bitwise shift when interpreting header length or type fields derived from untrusted network input. The malformed shift produces an out-of-range value that is then used to size or index a fixed stack buffer. Writing beyond this buffer corrupts adjacent stack memory, including saved registers and return addresses in native code. The condition is classified as a stack-based buffer overflow under [CWE-121].

The CVSS v4.0 vector indicates availability impact only, consistent with reliable crashes of the Thrift process rather than confirmed code execution. Any process linking the vulnerable library and exposing a Thrift endpoint using THeaderProtocol is reachable. The EPSS probability currently sits near 0.46%.

Root Cause

The root cause is an incorrect bitwise shift of an integer derived from attacker-controlled header bytes. The shift produces a size or offset value that exceeds the capacity of a stack-allocated buffer. The code then performs a write using that value without validating it against the destination bounds. This combination of untrusted input, flawed arithmetic, and missing bounds checks triggers the stack corruption.

Attack Vector

Exploitation requires only network reachability to a service that parses THeaderProtocol frames. No authentication or user interaction is needed. An attacker sends a crafted Thrift message whose header fields trigger the faulty shift calculation during deserialization. The affected endpoint processes the frame, overflows the stack buffer, and terminates. Repeated requests sustain denial of service against the target. Technical specifics are described in the Apache Security Mailing List Discussion and the Apache Security Update Thread.

// No verified public proof-of-concept is available.
// Refer to the Apache security advisories linked above for details.

Detection Methods for CVE-2026-93925

Indicators of Compromise

Unexpected crashes, segmentation faults, or core dumps in services linking Apache Thrift C++ below 0.25.0
Repeated short-lived TCP connections to Thrift listener ports followed by process restarts
Thrift server logs showing deserialization failures or abrupt termination during header parsing

Detection Strategies

Inventory binaries and containers for libthrift C++ versions earlier than 0.25.0 using software composition analysis
Inspect Thrift traffic for malformed THeaderProtocol frames with anomalous header length or flag fields
Correlate process termination events on hosts running Thrift services with inbound network flows to the Thrift port

Monitoring Recommendations

Alert on crash loops or supervisor-driven restarts of Thrift-based services
Capture and retain network metadata for Thrift listener ports to support post-incident analysis
Track CVE feeds and distribution advisories for downstream packages that bundle Apache Thrift

How to Mitigate CVE-2026-93925

Immediate Actions Required

Upgrade Apache Thrift C++ to version 0.25.0 or later in all affected services and dependencies
Rebuild and redeploy any statically linked binaries that embed vulnerable Thrift C++ code
Restrict network exposure of Thrift endpoints to trusted clients until patching is complete

Patch Information

Apache Thrift version 0.25.0 fixes the incorrect bitwise shift and the resulting stack-based buffer overflow in THeaderProtocol. Review the Apache Security Update Thread for release details and the Apache Security Mailing List Discussion for the disclosure context. Downstream Linux distributions and language bindings that package the C++ library should be updated once vendor-rebuilt packages become available.

Workarounds

Place Thrift services behind authenticated gateways or mutual TLS to limit who can submit frames
Apply network segmentation and firewall rules so Thrift ports are not reachable from untrusted networks
Switch to a different Thrift protocol binding where feasible if THeaderProtocol is not required

bash

# Example: verify installed Apache Thrift C++ version and upgrade
thrift --version
# Expect output showing 0.25.0 or later after upgrading