CVE-2026-43871
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
CVE-2026-43871- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2026-49146
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
EUVD-2026-49146- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8wv5-x4w7-5gww
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
GHSA-8wv5-x4w7-5gww- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
CVE-2026-43871- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
CVE-2026-43871- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-43871
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
DEBIAN-CVE-2026-43871- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 15 moreShow less
OSVGHSA-8wv5-x4w7-5gww
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
GHSA-8wv5-x4w7-5gww- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVPYSEC-2026-3926
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
PYSEC-2026-3926- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:49837
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:49837- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-43871
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
UBUNTU-CVE-2026-43871- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-93995 No score
CVE-2026-43871 affecting package thrift for versions less than 0.24.0-1
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
AZL-93995- Updated
- 2026-11-02
OSVAZL-94163 No score
CVE-2026-43871 affecting package kata-containers-preview 3.27.0~preview2-2
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
AZL-94163- Updated
- 2026-11-05
OSVAZL-94220 No score
CVE-2026-43871 affecting package influxdb for versions less than 2.7.5-20
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
AZL-94220- Updated
- 2026-11-02
OSVAZL-94235 No score
CVE-2026-43871 affecting package kata-containers-cc for versions less than 3.15.0.aks0-20
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
AZL-94235- Updated
- 2026-11-05
OSVAZL-94320 No score
CVE-2026-43871 affecting package telegraf for versions less than 1.31.0-26
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
AZL-94320- Updated
- 2026-11-05
OSVAZL-94329 No score
CVE-2026-43871 affecting package vitess for versions less than 19.0.4-12
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
AZL-94329- Updated
- 2026-11-05
OSVBIT-thrift-2026-43871 No score
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Record
BIT-thrift-2026-43871- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11432-1 No score
libthrift-0_24_0-0.24.0-1.1 on GA media
These are all security issues fixed in the libthrift-0_24_0-0.24.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11432-1- Updated
- 2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-43871 No score
CVE-2026-43871 in github.com/apache/thrift - Patched by Root
Root has patched CVE-2026-43871 in the github.com/apache/thrift package for Root:Go. Multiple fixed versions available.
- Record
ROOT-APP-GOBINARY-CVE-2026-43871- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-43871 No score
CVE-2026-43871 in org.apache.thrift:libthrift - Patched by Root
Root has patched CVE-2026-43871 in the org.apache.thrift:libthrift package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-43871- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-43871 No score
CVE-2026-43871 in thrift - Patched by Root
Root has patched CVE-2026-43871 in the thrift package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-43871- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thriftPyPI |
before 0.24.0 | 0.24.0 |
github.com/apache/thriftGo |
before 0.24.0 | 0.24.0 |
apache/thriftPackagist |
before 0.24.0 | 0.24.0 |
org.apache.thrift:libthriftMaven |
before 0.24.0 | 0.24.0 |
thriftAzure Linux:3 |
before 0.24.0-1 | 0.24.0-1 |
kata-containers-previewAzure Linux:3 |
through 3.27.0~preview2-2 | None known |
influxdbAzure Linux:3 |
before 2.7.5-20 | 2.7.5-20 |
kata-containers-ccAzure Linux:3 |
before 3.15.0.aks0-20 | 3.15.0.aks0-20 |
telegrafAzure Linux:3 |
before 1.31.0-26 | 1.31.0-26 |
vitessAzure Linux:3 |
before 19.0.4-12 | 19.0.4-12 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
thriftBitnami |
before 0.24.0 | 0.24.0 |
thriftDebian:12 |
All versions, plus listed versions 0.17.0-20.17.0-30.17.0-40.18.1-10.18.1-2 Show 17 moreShow less0.19.0-10.19.0-20.19.0-2.10.19.0-2.1~exp10.19.0-30.19.0-40.20.0-10.22.0-10.22.0-20.22.0-30.22.0-40.23.0-10.23.0-20.23.0-30.24.0-10.24.0-20.24.0-3 |
None known |
thriftDebian:13 |
All versions, plus listed versions 0.19.0-40.20.0-10.22.0-10.22.0-20.22.0-3 Show 7 moreShow less0.22.0-40.23.0-10.23.0-20.23.0-30.24.0-10.24.0-20.24.0-3 |
None known |
thriftDebian:14 |
before 0.24.0-2, plus listed versions 0.19.0-40.20.0-10.22.0-10.22.0-20.22.0-3 Show 5 moreShow less0.22.0-40.23.0-10.23.0-20.23.0-30.24.0-1 |
0.24.0-2 |
thriftPyPI |
before 0.24.0, plus listed versions 0.10.00.11.00.13.00.14.00.14.1 Show 12 moreShow less0.14.20.15.00.16.00.20.00.21.00.22.00.23.00.8.00.9.00.9.10.9.20.9.3 |
0.24.0 |
apache/thriftPackagist |
before 0.24.0, plus listed versions 0.10.00.11.00.9.00.9.20.9.3 Show 16 moreShow less0.9.3.1v0.12.0v0.13.0v0.14.0v0.14.1v0.14.2v0.15.0v0.16.0v0.17.0v0.18.0v0.18.1v0.19.0v0.20.0v0.21.0v0.22.0v0.23.0 |
0.24.0 |
org.apache.thrift:libthriftMaven |
before 0.24.0, plus listed versions 0.10.00.11.00.12.00.13.00.14.0 Show 20 moreShow less0.14.10.14.20.15.00.16.00.17.00.18.00.18.10.19.00.20.00.21.00.22.00.23.00.6.10.7.00.8.00.9.00.9.10.9.20.9.30.9.3-1 |
0.24.0 |
perl-thriftRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:0.24.0-0.1.hum1 | 0:0.24.0-0.1.hum1 |
python3-thriftRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:0.24.0-0.1.hum1 | 0:0.24.0-0.1.hum1 |
thriftRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:0.24.0-0.1.hum1 | 0:0.24.0-0.1.hum1 |
thrift-develRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:0.24.0-0.1.hum1 | 0:0.24.0-0.1.hum1 |
thrift-glibRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:0.24.0-0.1.hum1 | 0:0.24.0-0.1.hum1 |
thrift-qtRed Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:0.24.0-0.1.hum1 | 0:0.24.0-0.1.hum1 |
github.com/apache/thriftRoot:Go |
before v0.21.0-aikido.3 | v0.21.0-aikido.3v0.23.0-aikido.1 |
rootio-github.com/apache/thriftRoot:Go |
before v0.21.0-root.io.3 | v0.21.0-root.io.3v0.23.0-root.io.1 |
org.apache.thrift:libthriftRoot:Maven |
before 0.18.1-aikido.1 | 0.18.1-aikido.10.23.0-aikido.10.22.0-aikido.3 |
io.root.org.apache.thrift:libthriftRoot:Maven |
before 0.23.0-root.io.1 | 0.23.0-root.io.10.18.1-root.io.10.22.0-root.io.3 |
thriftRoot:PyPI |
before 0.20.0+aikido.1 | 0.20.0+aikido.1 |
libthrift-javaUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.1-20.9.1-2.1~build0.16.04.1 |
None known |
libthrift-javaUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.1-20.9.1-2.1~build0.18.04.1 |
None known |
thriftUbuntu:20.04:LTS |
All versions, plus listed versions 0.11.0-60.13.0-2build10.13.0-2build2 |
None known |
libthrift-javaUbuntu:22.04:LTS |
All versions, plus listed versions 0.13.0-10.13.0-2 |
None known |
thriftUbuntu:22.04:LTS |
All versions, plus listed versions 0.13.0-6ubuntu10.13.0-6ubuntu20.13.0-6ubuntu30.13.0-70.16.0-2 |
None known |
libthrift-javaUbuntu:24.04:LTS |
All versions, plus listed versions 0.16.0-20.19.0-1 |
None known |
thriftUbuntu:24.04:LTS |
All versions, plus listed versions 0.17.0-40.19.0-20.19.0-2build10.19.0-2.1build40.19.0-2.1build5 |
None known |
libthrift-javaUbuntu:26.10 |
All versions, plus listed versions 0.19.0-1 |
None known |
thriftUbuntu:26.10 |
All versions, plus listed versions 0.22.0-3ubuntu10.23.0-30.23.0-3ubuntu1 |
None known |
libthrift-javaUbuntu:26.04:LTS |
All versions, plus listed versions 0.19.0-1 |
None known |
thriftUbuntu:26.04:LTS |
All versions, plus listed versions 0.19.0-4build10.22.0-30.22.0-3ubuntu1 |
None known |
thriftopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 0.24.0-1.1 | 0.24.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-43871 is a high vulnerability (CVSS 8.7) in Apache Thrift, published July 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in thrift 0.24.0.
References
lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
openwall.com/lists/oss-security/2026/07/24/33
nvd.nist.gov/vuln/detail/CVE-2026-43871
github.com/advisories/GHSA-8wv5-x4w7-5gww
packagist.org
Show 74 moreShow less
proxy.golang.org
pypi.python.org
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-43871
pypi.org/project/thrift
access.redhat.com/errata/RHSA-2026:49837
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49837.json
bugzilla.redhat.com/show_bug.cgi?id=2507442
cve.org/CVERecord?id=CVE-2026-41608
ubuntu.com/security/CVE-2026-43871
suse.com/security/cve/CVE-2026-41608