CVE-2026-43871High· 7.5▾ TwilightA flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.6%
0.6% → 1.0%
Last analysed / modified upstream
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service (DoS) for applications using the affected bindings.
thrift: Apache Thrift: Denial of Service via infinite loop — rated Important by Red Hat. Released 2026-07-27, updated 2026-10-02.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:49837
Affected packages:
thrift < 0.24.0github.com/apache/thrift < 0.24.0apache/thrift < 0.24.0org.apache.thrift:libthrift < 0.24.0Patched in:
thrift 0.24.0github.com/apache/thrift 0.24.0apache/thrift 0.24.0org.apache.thrift:libthrift 0.24.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-66053Medium· 5.9thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation (CVE-2026-66053)
CVE-2026-112046Medium· 5.5org.ow2.asm/asm: OW2 ASM: Denial of Service via infinite loop in Label.resolve() (CVE-2026-112046)
CVE-2026-13346Medium· 5.9pip: pip: Arbitrary file installation via malicious package indexes (CVE-2026-13346)
CVE-2026-11972Medium· 6.5When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVE-2026-59890Medium· 6.1setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) (CVE-2026-59890)
CVE-2026-49852High· 7.5joserfc: joserfc: Integrity bypass via forged HMAC-signed tokens (CVE-2026-49852)