As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Apache Thrift Java bindings contain an uncontrolled recursion vulnerability in the TProtocolUtil.skip() method that does not enforce recursion depth limits by default. The vulnerability affects Apache Thrift versions before 0.24.0, and users are advised to upgrade to version 0.24.0 or later.
Why it matters: Development teams using Apache Thrift Java bindings in applications that accept untrusted serialized data face availability risk; attackers can trigger stack overflow conditions leading to denial of service without authentication.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Apache Thrift Java bindings prior to version 0.24.0 contain an uncontrolled recursion vulnerability in the TProtocolUtil.skip() function that does not limit recursion depth by default. An attacker with network access can trigger this condition to cause a denial of service. Version 0.24.0 addresses the issue.
Why it matters: Organizations using Apache Thrift Java library before 0.24.0 face availability risk; practitioners should evaluate and patch affected instances immediately.
- Source published
- First seen by Cybersecurity Tracker