CVE-2026-96287 in Thrift
Summary
by MITRE • 10/02/2026
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The identified vulnerability resides within the Perl language bindings of the Apache Thrift framework, specifically affecting versions prior to 0.25.0. Apache Thrift is a widely adopted cross-language service development framework that facilitates efficient and scalable inter-service communication by generating code for various programming languages from a single interface definition file. The security flaw in question is classified as an inefficient algorithmic complexity issue, commonly referred to in the industry as ReDoS or more broadly under CWE-400: Uncontrolled Resource Consumption. This category of vulnerability arises when software performs computations that have exponential time complexity relative to certain inputs, allowing a malicious actor to trigger disproportionate resource usage with relatively small input sizes.
The technical root cause lies in how the Perl bindings process serialized data structures defined by Thrift protocols. When parsing complex or deeply nested binary or text-based payloads, the underlying regular expression engines or string manipulation routines used within these specific binding implementations may exhibit catastrophic backtracking behavior. This means that for crafted inputs designed to exploit ambiguous patterns in the parsing logic, the CPU cycles required to resolve the input grow exponentially rather than linearly. An attacker can construct a specially formatted Thrift message payload that forces the parser into this worst-case scenario, effectively trapping the processing thread in an infinite or near-infinite loop of computation without producing useful output.
From an operational perspective, the impact of this vulnerability is primarily centered on availability and resource exhaustion. Since Apache Thrift servers often handle high volumes of concurrent requests from distributed systems, a single malicious request exploiting this flaw can consume significant CPU resources for an extended period. This leads to service degradation or complete denial of service for legitimate users sharing the same server instance. In cloud-native environments where auto-scaling is based on resource metrics such as CPU utilization, this attack could trigger unnecessary scaling events, leading to increased infrastructure costs and potential instability in the broader application ecosystem. The vulnerability does not typically allow for remote code execution or direct data exfiltration but serves as a potent vector for disrupting critical business operations by rendering services unresponsive.
To mitigate this risk, organizations running Apache Thrift Perl bindings must upgrade immediately to version 0.25.0 or later, where the algorithmic complexity issues have been addressed through optimized parsing logic and stricter input validation mechanisms. For environments that cannot be upgraded instantly due to dependency constraints, defensive measures should include implementing strict rate limiting on incoming requests to prevent any single client from overwhelming the server with high-frequency payloads. Additionally, deploying Web Application Firewalls or API gateways capable of inspecting payload size and structure can help filter out abnormally large or deeply nested Thrift messages before they reach the application layer. Monitoring CPU usage patterns for anomalies indicative of computational loops is also recommended to detect potential exploitation attempts in real time.
This vulnerability aligns with MITRE ATT&CK technique T1496: Resource Hijacking, where adversaries leverage system resources to disrupt availability or perform cryptomining-like activities through resource exhaustion. It also maps closely to CWE-787: Out-of-bounds Write if the inefficiency leads to memory corruption in adjacent versions, though primarily it is a performance-based denial of service vector under CWE-400. Ensuring that all components within the microservices architecture are updated to patched versions remains the most effective long-term strategy for maintaining resilience against such algorithmic complexity attacks.