CVE-2026-61374 Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit
HighCVSS 7.1
EPSS 0.25%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.thrift/libthrift(Maven) | < 0.25.0 | 0.25.0 |
| debian/thrift(Debian:12) | All versions | No fix listed |
| debian/thrift(Debian:12) | = 0.17.0-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.17.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.17.0-4 | No fix listed |
| debian/thrift(Debian:12) | = 0.18.1-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.18.1-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-2.1 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-2.1~exp1 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-4 | No fix listed |
| debian/thrift(Debian:12) | = 0.20.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-4 | No fix listed |
| debian/thrift(Debian:12) | = 0.23.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.23.0-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.23.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.24.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.24.0-2 | No fix listed |
| debian/thrift(Debian:13) | All versions | No fix listed |
| debian/thrift(Debian:13) | = 0.19.0-4 | No fix listed |
Show 27 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/thrift(Debian:13) | = 0.20.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-2 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-3 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-4 | No fix listed |
| debian/thrift(Debian:13) | = 0.23.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.23.0-2 | No fix listed |
| debian/thrift(Debian:13) | = 0.23.0-3 | No fix listed |
| debian/thrift(Debian:13) | = 0.24.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.24.0-2 | No fix listed |
| debian/thrift(Debian:14) | All versions | No fix listed |
| debian/thrift(Debian:14) | = 0.19.0-4 | No fix listed |
| debian/thrift(Debian:14) | = 0.20.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-2 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-3 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-4 | No fix listed |
| debian/thrift(Debian:14) | = 0.23.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.23.0-2 | No fix listed |
| debian/thrift(Debian:14) | = 0.23.0-3 | No fix listed |
| debian/thrift(Debian:14) | = 0.24.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.24.0-2 | No fix listed |
| ubuntu/libthrift-java(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libthrift-java(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libthrift-java(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libthrift-java(Ubuntu:26.10) | All versions | No fix listed |
| azure linux mtools(Azure Linux:3.0) | < 0.25.0-1 | 0.25.0-1 |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- lists.apache.org vendor-advisory
- lists.apache.org vendor-advisory
- Debian Security Tracker CVE-2026-61374 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- bugs.debian.org issue-tracking