CVE-2026-45112 in Thrift
Summary
by MITRE • 07/27/2026
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: from 0.19.0 before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings represents a critical security flaw that enables malicious actors to exploit resource consumption patterns within the framework's implementation. This vulnerability specifically impacts versions from 0.19.0 through 0.23.0, creating potential for resource exhaustion attacks that can disrupt service availability and compromise system stability. The issue stems from insufficient bounds checking and resource management controls within the Java bindings implementation, allowing attackers to manipulate resource allocation parameters beyond normal operational limits.
The technical flaw manifests when the Thrift Java bindings process incoming requests without adequate throttling mechanisms or resource consumption limits. This allows an attacker to submit malformed or excessively large data structures that trigger unbounded memory allocation and processing cycles. The vulnerability is particularly dangerous in distributed systems where Thrift services handle multiple concurrent connections, as it can lead to denial of service conditions through memory exhaustion or CPU starvation. The root cause aligns with CWE-770, which specifically addresses the allocation of resources without proper limits or throttling mechanisms, making this a well-documented pattern of resource management failure.
Operationally, this vulnerability creates significant risks for systems relying on Apache Thrift for inter-service communication and data exchange. An attacker can exploit the flaw by crafting requests that consume excessive memory or processing power, potentially leading to service disruption, system crashes, or complete unavailability of affected services. The impact extends beyond simple denial of service as it can also enable more sophisticated attacks such as cache poisoning or resource-based side-channel information leakage. In enterprise environments where Thrift is used for microservices communication, this vulnerability could compromise entire application stacks and create cascading failures across interconnected systems.
Organizations must implement immediate mitigation strategies to address this vulnerability before upgrading to the fixed version 0.24.0. The recommended approach involves deploying rate limiting controls at network boundaries and implementing proper resource monitoring to detect unusual consumption patterns. System administrators should configure memory limits and connection throttling rules within their Thrift service deployments to prevent unbounded resource allocation. Additionally, implementing automated alerting mechanisms for resource utilization thresholds can help identify exploitation attempts before they cause significant damage. The fix in version 0.24.0 addresses the core resource management issues by introducing proper bounds checking and implementing configurable limits on resource consumption. This aligns with ATT&CK technique T1499.004, which covers resource exhaustion attacks, and demonstrates the importance of implementing proper input validation and resource management controls in distributed systems. Security teams should also consider applying network segmentation and access controls to limit exposure of vulnerable Thrift services while performing the necessary upgrades.