Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-02T12:32:46 thrift: thrift: Denial of Service via excessive resource allocation in Delphi buffered transport 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-770

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

A flaw was found in Apache Thrift's Delphi bindings buffered transport. The component fails to properly restrict or throttle resource allocation when processing input. A remote, unauthenticated attacker could exploit this vulnerability to consume excessive system resources, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity rather than Important because exploitation is limited to denial-of-service conditions through unconstrained memory allocation without compromising system confidentiality or integrity. The affected buffered transport implementation is exclusive to Apache Thrift's Delphi language bindings. Because Red Hat enterprise distributions and supported products do not package or utilize Delphi components, standard installations are not exposed to this flaw. Red Hat Hardened Images 2026-10-01T00:00:00Z RHSA-2026:74369 thrift-main-0.25.0-0.1.hum1 Red Hat Ceph Storage 7 Fix deferred thrift Red Hat Ceph Storage 8 Fix deferred thrift Red Hat Ceph Storage 9 Out of support scope thrift Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred thrift https://www.cve.org/CVERecord?id=CVE-2026-66331 https://nvd.nist.gov/vuln/detail/CVE-2026-66331 https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143