Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-07-27T10:57:34
thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: from 0.19.0 before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or throttle resource allocation, leading to potential system instability or unresponsiveness.
This vulnerability is rated as Important. It stems from uncontrolled resource allocation in Apache Thrift Java bindings, which can lead to a denial of service. This impacts Red Hat products such as Red Hat OpenShift AI, Red Hat build of Apache Camel, Red Hat Ceph Storage, Red Hat Connectivity Link, and Cryostat, where services utilizing these vulnerable bindings could experience resource exhaustion and service disruption.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Confidential Compute Attestation
Not affected
openshift-sandboxed-containers/osc-podvm-payload-rhel9
Cryostat 4
Affected
cryostat/cryostat-storage-rhel9
Red Hat build of Apache Camel 4 for Quarkus 3
Affected
libthrift
Red Hat Ceph Storage 5
Fix deferred
rhceph/rhceph-5-dashboard-rhel8
Red Hat Ceph Storage 6
Fix deferred
rhceph/rhceph-6-dashboard-rhel9
Red Hat Ceph Storage 7
Fix deferred
rhceph/grafana-rhel9
Red Hat Ceph Storage 8
Fix deferred
rhceph/grafana-rhel9
Red Hat Ceph Storage 9
Fix deferred
rhceph/alloy-rhel10
Red Hat Connectivity Link 1
Affected
rhcl-1/authorino-rhel9
Red Hat Data Grid 8
Not affected
libthrift
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
thrift
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
libthrift
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift Container Platform 4
Not affected
conmon-rs
Red Hat OpenShift Container Platform 4
Not affected
kata-containers
Red Hat OpenShift Update Service
Not affected
openshift-update-service/openshift-update-service-rhel8
https://www.cve.org/CVERecord?id=CVE-2026-45112
https://nvd.nist.gov/vuln/detail/CVE-2026-45112
http://www.openwall.com/lists/oss-security/2026/07/24/34
https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
https://lists.apache.org/thread/hl9kmf1z2o3lxvspoj3g9ykl8lj9mdxc