CVE-2026-90440 — Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unaut…

CVE-2026-90440

Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service PUBLISHED

Description (CNA)

Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Thrift	affected 0 before 0.25.0

CWE

CWE-248, CWE-755, CWE-404

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.