CVE-2026-83745
Description
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) against the Node.js and D WebSocket server transports by sending a frame specifying an excessively large payload length. Because the server immediately allocates the declared amount of memory without verifying that the payload data has arrived, an attacker can rapidly exhaust system memory and crash the service.
Statement
This vulnerability is rated as Important due to the potential for unauthenticated remote attackers to cause severe memory exhaustion leading to service denial without requiring user interaction or elevated privileges. The flaw specifically impacts server endpoints implementing WebSocket transports within Thrift's Node.js or D language bindings. Red Hat environments and deployments that do not expose services over WebSockets or that utilize alternate language bindings (such as C++ or Python) are not susceptible to this attack vector.
Mitigation
Restrict network reachability to services exposing Apache Thrift WebSocket transports by limiting access to trusted IP addresses or binding exclusively to the loopback interface.
1. If remote access is not required, configure the application to listen only on localhost (127.0.0.1).
2. To restrict exposure using firewalld, remove the service port from public zones and allow access only from trusted IP subnets:
firewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR>
firewall-cmd --permanent --zone=trusted --add-port=<PORT>/tcp
firewall-cmd --reload
Caveat: Restricting network access prevents legitimate clients outside of the trusted subnet from connecting to the service.
Warning: Executing 'firewall-cmd --reload' applies configuration changes immediately and may disrupt active network connections.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
