Cyber ·
CVE-2026-120135: Apache Thrift does not limit Java TProtocolUtil.skip() recursion depth by default
Security advisory on uncontrolled recursion in Apache Thrift Java bindings before version 0.24.0, rated important with CVSS 4.0 score 8.2. The stated impact is availability.
The advisory CVE-2026-120135, published on the oss-sec feed on October 30, 2026 by Jens Geyer, states that the Apache Thrift Java bindings do not limit the recursion depth of the TProtocolUtil.skip() method by default. According to the text, the flaw can impact availability. It affects the org.apache.thrift:libthrift package before version 0.24.0, and the fix is in that version. The stated CVSS 4.0 score is 8.2 (high), with network vector, no privileges and no user interaction, high availability impact and no confidentiality or integrity impact. Credit for the discovery is given to Yu Bao.
For organizations using Thrift in Java services, the advisory recommends updating the library to version 0.24.0 or later. Those not using these bindings are not affected by what the text describes. This item is presented only as security information; Rota Nacional does not provide fixes for third-party libraries.
The original source is the oss-sec list, available at the address indicated in the feed itself. To verify, review the full advisory text, the libthrift dependency version in your project and the official vulnerability record before acting.