CVE-2026-66055
Description
A flaw was found in Apache Thrift. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted requests. Because the affected bindings fail to properly restrict resource allocation during request handling, an attacker can exhaust system resources and render the service unavailable.
Statement
This vulnerability is rated as an Important severity flaw because unauthenticated remote attackers can trigger extensive system resource consumption, leading to a complete service outage. In Red Hat environments where Apache Thrift server bindings process external RPC requests, missing bounds on data structures permit malicious callers to overwhelm host memory or processing capacity without requiring valid credentials. Although this issue does not compromise data confidentiality or integrity, the potential to remotely crash or hang production RPC services without prior authorization elevates the risk above Moderate.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
