Bug 2545170 (CVE-2026-83663)

Summary:	CVE-2026-83663 github.com/apache/thrift: Apache Thrift: Denial of Service via unbounded recursion in Go transports
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, akhatavk, alinfoot, amctagga, aoconnor, aos-team-art-private, asdas, blitton, bniver, cmah, dpaolell, dtrifiro, eaguilar, ebaron, eglynn, flucifre, gbenhaim, gmeno, gparvin, groman, jbalunas, jcantril, jdelft, jjoyce, jmatsuok, jpretori, jschluet, jtolenti, jupierce, kaycoth, lchilton, lgarciaa, lhh, mbarnett, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mwringe, niyer, pjindal, ppalepu, ppostler, prdhamdh, rhaigner, rhel-process-autobot, rojacob, sfeifer, sghai, sidsharm, sostapov, suppawar, tsze, twaugh, vereddy, vlaad, watson-tool-maintainers, weaton
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a loop, exhausting the execution stack. This stack exhaustion causes an unrecoverable fatal error that terminates the entire process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2546777, 2546778
Bug Blocks:

Description OSIDB Bzimport 2026-10-02 12:58:33 UTC

Uncontrolled Recursion vulnerability in Apache Thrift go bindings.



Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.