CVE-2026-83745 Denial of service in Apache Thrift
Attackers can cause denial of service by sending small WebSocket frames that trigger excessive memory allocation in Apache Thrift Node.js and D bindings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-83745?
CVE-2026-83745 is a high-severity denial of service vulnerability in Apache Thrift, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings.
Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again.
This issue affects Apache Thrift before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Which versions are affected by CVE-2026-83745?
1 open source package ship an affected version, including thrift.
| Package | Affected | Fixed in |
|---|---|---|
thrift Bitnami | All versions | 0.25.0 |
How do I fix CVE-2026-83745?
Upgrade thrift to 0.25.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-83745 being exploited?
There is no known exploitation of CVE-2026-83745 in the wild and no public exploit code.
Sources
Also known as AZL-105953, BIT-thrift-2026-83745, DEBIAN-CVE-2026-83745, GHSA-5jgj-9r28-q5fp, MINI-q6hc-47cc-phc8, UBUNTU-CVE-2026-83745.