CVE-2026-94650 in Thrift
Summary
by MITRE • 10/02/2026
Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The identified vulnerability represents a critical flaw within the C GLib bindings of the Apache Thrift framework, specifically affecting versions prior to 0.25.0. This uncontrolled recursion issue stems from improper handling of recursive data structures or method calls during serialization and deserialization processes. When processing complex nested objects or circular references, the binding layer fails to implement adequate depth limits or cycle detection mechanisms. Consequently, instead of terminating the operation upon detecting a loop or exceeding a predefined stack limit, the system continues to invoke functions recursively. This behavior leads directly to a stack overflow condition, which is a classic manifestation of uncontrolled recursion where the call stack exceeds its allocated memory space.
From a technical perspective, this flaw allows an attacker who can supply crafted input data containing deeply nested structures or circular references to trigger excessive function calls within the application process. The immediate operational impact is a denial of service against any system utilizing these vulnerable versions of Apache Thrift c_glib bindings. When the stack overflow occurs, the affected thread crashes, potentially bringing down the entire server process if exception handling is not robustly implemented at the higher level. This vulnerability does not inherently allow for remote code execution or direct data exfiltration in its primary form; however, it serves as a potent vector for disrupting service availability. In environments where Apache Thrift is used for high-throughput inter-service communication, such crashes can lead to significant downtime and require manual intervention to restart services, thereby impacting business continuity and user experience.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-675, which describes operations on data structures that are susceptible to uncontrolled recursion. It also relates closely to CWE-400, concerning unconstrained resource consumption, as the recursive calls consume stack memory until exhaustion occurs. In terms of attack patterns, this flaw can be leveraged within the context of MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving application or service crashes. Attackers typically exploit such vulnerabilities by sending specially crafted binary payloads over network connections that utilize Thrift for data exchange, targeting endpoints that parse these inputs without sufficient validation or depth checking.
Mitigation strategies primarily involve upgrading the Apache Thrift framework to version 0.25.0 or later, where this specific recursion handling issue has been resolved through improved input validation and stack depth monitoring. For organizations unable to immediately upgrade due to dependency constraints, implementing a reverse proxy or API gateway that inspects incoming payloads for excessive nesting levels can provide an additional layer of defense. Additionally, developers should ensure that any custom serialization logic adheres to strict limits on object depth and explicitly checks for circular references before processing. Regular security assessments focusing on input validation in high-level language bindings are recommended to identify similar patterns in other components of the software supply chain.