CVE-2026-96287
Description
A flaw was found in the Apache Thrift Perl bindings. A remote attacker could exploit this vulnerability by sending specially crafted input to an application using the affected bindings. This triggers inefficient data processing, leading to excessive resource consumption and a Denial of Service (DoS).
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can exhaust server CPU resources and induce a persistent denial of service without requiring user interaction or elevated privileges. In typical Red Hat environments, Apache Thrift Perl modules are not deployed in core system services by default and require custom applications utilizing framed transports or TLS sockets to be exposed to untrusted network traffic. The risk is therefore primarily confined to environments where custom Perl-based Thrift servers process unauthenticated external requests.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other); Reduce Performance
This issue can make the product perform more slowly. If an attacker can influence the number of iterations in the loop, then this performance problem might allow a denial of service by consuming more platform resources than intended.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
