CVE-2026-43871: Apache Thrift Infinite Loop Vulnerability in Python, Go, PHP, and Java Bindings
Summary
CVE-2026-43871: Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop. Affects thrift versions < 0.24.0. Fixed in 0.24.0. How to fix ↓
Also tracked for
- thrift · Bitnami
The same CVE-2026-43871 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Thrift is a software framework for scalable cross-language services development. It combines a software stack with a code generation engine to build services that can communicate seamlessly across different programming languages. The framework supports multiple languages, including Python, Go, PHP, and Java, making it a popular choice for developers building microservices. However, prior to version 0.24.0, the Thrift bindings for these languages contained a vulnerability that could lead to an infinite loop, potentially causing applications to hang indefinitely.
Vulnerability Detail
The vulnerability identified as CVE-2026-43871 is characterized by an infinite loop in the Apache Thrift bindings for Python, Go, PHP, and Java. This issue arises from a loop with an unreachable exit condition, which can cause applications to become unresponsive. The infinite loop can lead to resource exhaustion, impacting the performance and availability of services that rely on the affected Thrift bindings. This vulnerability affects all versions of Apache Thrift prior to 0.24.0, making it critical for users to address it promptly.
How To Fix
Latest published version: 0.25.0 as of 23 Oct 2026
pip install --upgrade "thrift==0.25.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.24.0
This is the first release that contains the fix.
pip install --upgrade "thrift==0.24.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement checks in their application logic to handle potential infinite loops, such as setting timeouts for operations that utilize the Thrift bindings. However, this is not a substitute for upgrading to the patched version.
Conclusion
The CVE-2026-43871 vulnerability in Apache Thrift poses a significant risk due to its potential to cause infinite loops in applications using the affected bindings. Users are strongly advised to upgrade to version 0.24.0 or later to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for thrift →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of Apache Thrift prior to 0.24.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The infinite loop can cause applications to hang, leading to resource exhaustion and impacting the performance and availability of services.
While upgrading is the recommended solution, implementing application-level checks and timeouts can help mitigate the risk temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for thrift.
