CVE-2026-66054
Received Received - Intake

Allocation of Resources Without Limits in Apache Thrift C++ Bindings

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-66054
EUVD
EUVD-2026-91630

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of highly compressed data in Apache Thrift C++ bindings, leading to excessive resource allocation without proper limits. This can cause data amplification, where small input data expands significantly during processing, potentially overwhelming system resources.

Detection Guidance

Detection involves checking the Apache Thrift version in use. Commands like 'thrift --version' or inspecting package managers (e.g., 'dpkg -l | grep thrift' for Debian/Ubuntu) can identify vulnerable versions before 0.25.0.

Impact Analysis

An attacker could exploit this to cause denial-of-service by consuming excessive memory or CPU, leading to system slowdowns or crashes. Systems using vulnerable Apache Thrift versions may become unresponsive under crafted input.

Compliance Impact

This vulnerability involves improper handling of highly compressed data leading to resource exhaustion, which could disrupt system availability. While not directly tied to data privacy, such disruptions may impact compliance with GDPR (availability requirements) or HIPAA (system integrity and availability). However, no specific compliance impact is detailed in the provided CVE data.

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later immediately. Follow standard upgrade procedures for your system or container environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart