CVE-2019-0205: Loop with Unreachable Exit Condition in Apache Thrift
Summary
CVE-2019-0205: Loop with Unreachable Exit Condition in Apache Thrift. Affects org.apache.thrift:libthrift versions < 0.13.0. Fixed in 0.13.0. How to fix ↓
Also tracked for
- thrift · Debian:11
The same CVE-2019-0205 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Thrift is an open-source software framework for scalable cross-language services development. It allows efficient and reliable communication between different programming languages. The libthrift package is a core component of Apache Thrift, providing the necessary libraries and tools for building Thrift-based applications. However, versions up to and including 0.12.0 of Apache Thrift's libthrift package are vulnerable to a specific issue that can lead to an endless loop when certain input data is provided. This vulnerability affects certain language bindings depending on the installed version.
Vulnerability Detail
The vulnerability in Apache Thrift arises from a loop with an unreachable exit condition. When the server or client is fed with specific input data, it can get stuck in an infinite loop. This issue was partially fixed in version 0.11.0, so the impact may vary depending on the installed version. The consequences of this vulnerability can include denial-of-service (DoS) situations, where the affected server or client becomes unresponsive due to the endless loop. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-835.
How To Fix
Latest published version: 0.25.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a newer version of Apache Thrift is not immediately feasible, a possible workaround is to implement input validation and sanitization mechanisms. By carefully validating and sanitizing the input data, it may be possible to prevent the triggering of the loop with unreachable exit condition. However, this workaround is not a definitive solution and should be considered temporary until the upgrade can be performed.
Conclusion
In conclusion, Apache Thrift versions up to and including 0.12.0 are vulnerable to a loop with an unreachable exit condition. This can result in denial-of-service situations and impact the availability of the affected server or client. To mitigate this vulnerability, it is recommended to upgrade to Apache Thrift version 0.13.0 or newer. Input validation and sanitization mechanisms can serve as temporary workarounds until the upgrade can be performed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.thrift:libthrift →
FAQ
Apache Thrift is an open-source software framework for scalable cross-language services development. It enables efficient communication between different programming languages.
All versions up to and including 0.12.0 of Apache Thrift's libthrift package are affected by this vulnerability.
The vulnerability can lead to denial-of-service (DoS) situations, where the affected server or client becomes unresponsive due to an endless loop.
Yes, the vulnerability has been partially fixed in version 0.11.0 of Apache Thrift. However, depending on the installed version, certain language bindings may still be affected.
The CWE ID associated with this vulnerability is CWE-835.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.thrift:libthrift.
