CVE-2026-86537 — Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to…

CVE-2026-86537

Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service PUBLISHED

Description (CNA)

Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Thrift	affected 0 before 0.25.0

CWE

CWE-248, CWE-835, CWE-191

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.