CVE-2026-66331 in Thrift
Summary
by MITRE • 10/02/2026
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The identified vulnerability represents a critical flaw within the buffered transport mechanism of the Delphi bindings for Apache Thrift, specifically affecting versions prior to 0.25.0. This security defect is categorized under CWE-770: Allocation of Resources Without Limits or Throttling, which describes scenarios where an application allocates resources without imposing restrictions on quantity or rate. In the context of networked applications utilizing RPC frameworks like Thrift, such flaws often manifest as resource exhaustion vulnerabilities that can be leveraged by attackers to disrupt service availability. The Delphi bindings serve as a bridge allowing Delphi-based clients and servers to communicate with services built in other languages supported by Thrift, making this component integral for organizations maintaining legacy or specialized systems within their infrastructure.
The technical root cause lies in the handling of buffered transport operations where memory allocation is not properly constrained relative to incoming data sizes or request rates. When a client sends a request through the Delphi binding's buffered transport layer, the system may allocate buffers dynamically based on the content length without verifying if the size exceeds reasonable limits or checking against available system resources. This lack of validation allows an attacker to craft maliciously large requests that force the server or intermediate components to consume excessive amounts of memory. Because the allocation process does not implement throttling mechanisms such as rate limiting, connection pooling caps, or maximum buffer sizes, a single sustained attack can rapidly deplete available heap space on the host system.
The operational impact of this vulnerability is primarily centered around denial-of-service conditions. By exploiting the unbounded resource allocation, an attacker can trigger out-of-memory errors that cause the Thrift server process to crash or become unresponsive. In distributed environments where Apache Thrift handles high volumes of inter-service communication, such instability can lead to cascading failures across dependent services. This not only disrupts business operations but also potentially exposes sensitive data if error messages reveal internal stack traces or configuration details during the failure state. Furthermore, repeated exploitation attempts may degrade overall system performance due to garbage collection overhead and memory fragmentation before a complete crash occurs.
Mitigation strategies focus on immediate version upgrades and architectural hardening. The primary remediation is to upgrade Apache Thrift to version 0.25.0 or later, where the developers have implemented proper bounds checking and resource limits within the Delphi buffered transport implementation. For environments unable to patch immediately due to compatibility constraints, administrators should consider placing a reverse proxy or API gateway in front of the Thrift service to enforce request size limits and rate limiting at the network perimeter. Additionally, configuring operating-level memory limits for the application process can provide an additional layer of defense by preventing any single process from consuming all available system RAM. Monitoring tools should be deployed to detect abnormal spikes in memory usage associated with specific client IPs or endpoints, enabling rapid identification and blocking of potential exploitation attempts.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1496: Resource Hijacking, specifically the sub-technique related to resource exhaustion through denial-of-service attacks. Adversaries often utilize such flaws as part of broader campaigns aimed at disrupting critical infrastructure or creating distractions for more intrusive activities. Understanding the mechanics of unbounded allocation helps security teams recognize similar patterns in other RPC frameworks and custom network protocols. Regular vulnerability assessments should include checks for proper input validation and resource management practices, ensuring that future development adheres to secure coding standards such as those outlined in OWASP guidelines for API security and memory safety.