CVE-2026-63772 — Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

CVE-2026-63772

Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count PUBLISHED

Description (CNA)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Thrift	affected 0 before 0.25.0

CWE

CWE-770

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
https://lists.apache.org/thread/6kpzdw29gsfxptv4b65y9s6f42tdyo8k

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.