CVE-2020-13949

Uncontrolled Resource Consumption in Apache Thrift

7.5 HighFix available

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

6.78%Down 29.9 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: CVE-2020-13949
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-400
Updated: 2026-11-02

CVE List No score

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: CVE-2020-13949
Updated: 2026-11-02

EUVDEUVD-2021-0656 No score

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: EUVD-2021-0656
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g2fg-mr77-6vrm 7.5

Uncontrolled Resource Consumption in Apache Thrift

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: GHSA-g2fg-mr77-6vrm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVALPINE-CVE-2020-13949 7.5

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: ALPINE-CVE-2020-13949
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 7.5

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: CVE-2020-13949
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVDEBIAN-CVE-2020-13949 7.5

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: DEBIAN-CVE-2020-13949
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-g2fg-mr77-6vrm 7.5

Uncontrolled Resource Consumption in Apache Thrift

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: GHSA-g2fg-mr77-6vrm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVRHSA-2025:9582 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update

Record: RHSA-2025:9582
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-13949 7.5

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: UBUNTU-CVE-2020-13949
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-thrift-2020-13949 No score

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: BIT-thrift-2020-13949
Updated: 2026-11-02

OSVCLSA-2025-1750809966 No score

TuxCare security update for org.apache.thrift:libthrift (1 CVE)

TuxCare rebuilt org.apache.thrift:libthrift to address 1 CVE. Fixed in 0.9.3.tuxcare.1.

Record: CLSA-2025-1750809966
Updated: 2026-11-02

OSVMGASA-2021-0578 No score

Updated thrift/golang-github-apache-thrift packages fix security vulnerability

Malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Record: MGASA-2021-0578
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11459-1 No score

libthrift-0_14_1-0.14.1-1.6 on GA media

These are all security issues fixed in the libthrift-0_14_1-0.14.1-1.6 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11459-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.thrift:libthrift` Maven	0.9.3 up to 0.14.0	0.14.0
`thrift` Alpine:v3.15	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.16	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.17	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.18	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.19	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.20	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.21	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.22	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Alpine:v3.23	0.9.3 up to 0.14.0-r0	0.14.0-r0

Show 42 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-13949 is a high vulnerability (CVSS 7.5) in Apache Thrift, published February 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.78%, the 93rd percentile. Fixed in org.apache.thrift:libthrift 0.14.0.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 91 references. The JSON record has them.

Package	Affected	Fixed
`thrift` Alpine:v3.24	0.9.3 up to 0.14.0-r0	0.14.0-r0
`thrift` Bitnami	0.9.3 to 0.13.0	None known
`org.apache.thrift:libthrift` TuxCare:Maven	0.9.3 up to 0.9.3.tuxcare.1	0.9.3.tuxcare.1
`thrift` Debian:12	before 0.16.0-3	0.16.0-3
`thrift` Debian:13	before 0.16.0-3	0.16.0-3
`thrift` Debian:14	before 0.16.0-3	0.16.0-3
`org.apache.thrift:libthrift` Maven	0.9.3 up to 0.14.0, plus listed versions 0.10.00.11.00.12.00.13.00.9.3-1	0.14.0
`thrift` Mageia:8	before 0.14.0-1.mga8	0.14.0-1.mga8
`golang-github-apache-thrift` Mageia:8	before 0.14.0-1.mga8	0.14.0-1.mga8
`eap7-glassfish-el` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:3.0.1-4.b08_redhat_00005.1.ep7.el7	0:3.0.1-4.b08_redhat_00005.1.ep7.el7
`eap7-glassfish-el-impl` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:3.0.1-4.b08_redhat_00005.1.ep7.el7	0:3.0.1-4.b08_redhat_00005.1.ep7.el7
`eap7-hibernate` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7	0:5.1.17-3.Final_redhat_00004.1.ep7.el7
`eap7-hibernate-core` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7	0:5.1.17-3.Final_redhat_00004.1.ep7.el7
`eap7-hibernate-entitymanager` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7	0:5.1.17-3.Final_redhat_00004.1.ep7.el7
`eap7-hibernate-envers` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7	0:5.1.17-3.Final_redhat_00004.1.ep7.el7
`eap7-hibernate-infinispan` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7	0:5.1.17-3.Final_redhat_00004.1.ep7.el7
`eap7-hibernate-java8` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7	0:5.1.17-3.Final_redhat_00004.1.ep7.el7
`eap7-jackson-databind` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7	0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7
`eap7-jboss-ejb-client` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:4.0.12-1.Final_redhat_00002.1.ep7.el7	0:4.0.12-1.Final_redhat_00002.1.ep7.el7
`eap7-netty` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:4.1.63-2.Final_redhat_00003.1.ep7.el7	0:4.1.63-2.Final_redhat_00003.1.ep7.el7
`eap7-netty-all` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:4.1.63-2.Final_redhat_00003.1.ep7.el7	0:4.1.63-2.Final_redhat_00003.1.ep7.el7
`eap7-undertow` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.4.18-16.SP14_redhat_00001.1.ep7.el7	0:1.4.18-16.SP14_redhat_00001.1.ep7.el7
`eap7-wildfly` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:7.1.11-4.GA_redhat_00002.1.ep7.el7	0:7.1.11-4.GA_redhat_00002.1.ep7.el7
`eap7-wildfly-elytron` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.1.14-1.Final_redhat_00001.1.ep7.el7	0:1.1.14-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-http-client` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7	0:1.0.21-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-http-client-common` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7	0:1.0.21-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-http-ejb-client` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7	0:1.0.21-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-http-naming-client` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7	0:1.0.21-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-http-transaction-client` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7	0:1.0.21-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-modules` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:7.1.11-4.GA_redhat_00002.1.ep7.el7	0:7.1.11-4.GA_redhat_00002.1.ep7.el7
`eap7-wildfly-naming-client` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.13-1.Final_redhat_00001.1.ep7.el7	0:1.0.13-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-openssl` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.12-1.Final_redhat_00001.1.ep7.el7	0:1.0.12-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-openssl-java` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.12-1.Final_redhat_00001.1.ep7.el7	0:1.0.12-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-openssl-linux` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.12-6.Final_redhat_00001.1.ep7.el7	0:1.0.12-6.Final_redhat_00001.1.ep7.el7
`eap7-wildfly-openssl-linux-debuginfo` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.0.12-6.Final_redhat_00001.1.ep7.el7	0:1.0.12-6.Final_redhat_00001.1.ep7.el7
`thrift` Ubuntu:20.04:LTS	All versions, plus listed versions 0.11.0-60.13.0-2build10.13.0-2build2	None known
`thrift` Ubuntu:22.04:LTS	All versions, plus listed versions 0.13.0-6ubuntu10.13.0-6ubuntu20.13.0-6ubuntu30.13.0-70.16.0-2	None known
`thrift` Ubuntu:24.04:LTS	All versions, plus listed versions 0.17.0-40.19.0-20.19.0-2build10.19.0-2.1build40.19.0-2.1build5	None known
`thrift` Ubuntu:25.10	All versions, plus listed versions 0.19.0-4build1	None known
`thrift` Ubuntu:26.10	All versions, plus listed versions 0.22.0-3ubuntu10.23.0-30.23.0-3ubuntu1	None known
`thrift` Ubuntu:26.04:LTS	All versions, plus listed versions 0.19.0-4build10.22.0-30.22.0-3ubuntu1	None known
`thrift` openSUSE:Tumbleweed	before 0.14.1-1.6	0.14.1-1.6