CVE-2026-85493 in Thrift
Summary
by MITRE • 10/02/2026
Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The identified uncontrolled recursion vulnerability within the Apache Thrift Dart and Java ME bindings represents a significant risk to application stability and availability. This flaw exists in versions of Apache Thrift prior to release 0.25.0. The core technical deficiency lies in how these specific language bindings handle recursive data structures or nested serialization operations without adequate depth limiting mechanisms. When processing deeply nested or maliciously crafted input, the deserialization logic can trigger a chain of function calls that exceeds the available stack space allocated by the runtime environment. This lack of boundary control allows an attacker to induce a stack overflow condition through carefully constructed payloads designed to exploit the recursive nature of the Thrift protocol parsing engine.
From a technical perspective, this vulnerability is classified under CWE-675, which denotes operations with uncontrolled recursion depth. In the context of Apache Thrift, the serialization and deserialization processes are central to inter-service communication. If an application accepts data from external or semi-trusted sources without validating the structural complexity of that data, it becomes susceptible to this flaw. The Dart and Java ME bindings, often used in resource-constrained environments such as mobile devices or embedded systems, may have particularly restrictive stack sizes compared to standard server-side JVM implementations. Consequently, even moderately deep recursion can lead to immediate application crashes rather than graceful error handling, making these platforms disproportionately affected by the issue.
The operational impact of this vulnerability is primarily centered on service availability and system reliability. A successful exploitation attempt results in a denial-of-service condition where the targeted process terminates unexpectedly due to stack overflow errors. For applications relying on Apache Thrift for high-throughput or real-time data exchange, such crashes can lead to significant downtime, loss of client connections, and potential data inconsistency if transactions are interrupted mid-processing. In mobile contexts utilizing Java ME, a crash may force the application to restart, degrading user experience and potentially causing state loss. Furthermore, repeated exploitation attempts could consume excessive CPU resources during stack unwinding or garbage collection cycles, further exacerbating performance degradation across the host system.
Mitigation strategies must prioritize immediate version upgrades as the primary defense vector. Organizations running affected versions of Apache Thrift should upgrade to 0.25.0 or later, where this specific recursion handling logic has been corrected with appropriate depth checks and safeguards. For environments where upgrading is not immediately feasible, defensive coding practices can provide temporary relief. Developers should implement strict input validation on all incoming serialized data streams, ensuring that nested structures do not exceed predefined complexity thresholds before they are passed to the Thrift deserializer. Additionally, configuring runtime stack size limits or employing wrapper functions that monitor call depth can help contain potential overflows until a permanent patch is applied. Regular security audits of serialization logic and adherence to secure coding standards such as those outlined in OWASP guidelines for data validation will further reduce exposure to similar recursive flaws across the software supply chain.