Fluid Attacks Database

Description

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 13	thrift	=0.19.0-4 \|\| =0.20.0-1 \|\| =0.22.0-1 \|\| =0.22.0-2 \|\| =0.22.0-3 \|\| =0.22.0-4 \|\| =0.23.0-1 \|\| =0.23.0-2 \|\| =0.23.0-3 \|\| =0.24.0-1 \|\| =0.24.0-2
debian 14	thrift	=0.19.0-4 \|\| =0.20.0-1 \|\| =0.22.0-1 \|\| =0.22.0-2 \|\| =0.22.0-3 \|\| =0.22.0-4 \|\| =0.23.0-1 \|\| =0.23.0-2 \|\| =0.23.0-3 \|\| =0.24.0-1 \|\| =0.24.0-2
debian 12	thrift	=0.17.0-2 \|\| =0.17.0-3 \|\| =0.17.0-4 \|\| =0.18.1-1 \|\| =0.18.1-2 \|\| =0.19.0-1 \|\| =0.19.0-2 \|\| =0.19.0-2.1 \|\| =0.19.0-2.1~exp1 \|\| =0.19.0-3 \|\| =0.19.0-4 \|\| =0.20.0-1 \|\| =0.22.0-1 \|\| =0.22.0-2 \|\| =0.22.0-3 \|\| =0.22.0-4 \|\| =0.23.0-1 \|\| =0.23.0-2 \|\| =0.23.0-3 \|\| =0.24.0-1 \|\| =0.24.0-2

Aliases

1. CVE-2026-668582. NVD-2026-668583. OSV-DEBIAN-2026-668584. OSV-2026-668585. SECURITY-TRACKER-CVE-2026-66858

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.