Vulnpedia
← All CVEs

CVE-2026-43871

HIGH 8.7 ALL-YEARS

Published 2026-07-27 · Last modified 2026-07-27 · apache · NVD: Analyzed

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

1.0%chance of exploitation in 30 days · 63rd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

8.7CVSS 4.0 · HIGH · CNA

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Apache Software Foundation Apache

Products Apache Thrift Thrift

Weakness (CWE)

  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • thrift PyPI

    pkg:pypi/thrift

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.24.0
    17 explicitly listed affected versions

    0.10.0, 0.11.0, 0.13.0, 0.14.0, 0.14.1, 0.14.2, 0.15.0, 0.16.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.8.0, 0.9.0, 0.9.1, 0.9.2, 0.9.3

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8wv5-x4w7-5gww/GHSA-8wv5-x4w7-5gww.json"
  }
}
    GitHub Advisory Database · GHSA-8wv5-x4w7-5gww · Updated 2026-09-10T12:25:42.392618810Z
  • github.com/apache/thrift Go

    pkg:golang/github.com/apache/thrift

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.24.0
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8wv5-x4w7-5gww/GHSA-8wv5-x4w7-5gww.json"
  }
}
    GitHub Advisory Database · GHSA-8wv5-x4w7-5gww · Updated 2026-09-10T12:25:42.392618810Z
  • apache/thrift Packagist

    pkg:composer/apache/thrift

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.24.0
    21 explicitly listed affected versions

    0.10.0, 0.11.0, 0.9.0, 0.9.2, 0.9.3, 0.9.3.1, v0.12.0, v0.13.0, v0.14.0, v0.14.1, v0.14.2, v0.15.0, v0.16.0, v0.17.0, v0.18.0, v0.18.1, v0.19.0, v0.20.0, v0.21.0, v0.22.0, v0.23.0

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8wv5-x4w7-5gww/GHSA-8wv5-x4w7-5gww.json"
  }
}
    GitHub Advisory Database · GHSA-8wv5-x4w7-5gww · Updated 2026-09-10T12:25:42.392618810Z
  • org.apache.thrift:libthrift Maven

    pkg:maven/org.apache.thrift/libthrift

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.24.0
    25 explicitly listed affected versions

    0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.14.1, 0.14.2, 0.15.0, 0.16.0, 0.17.0, 0.18.0, 0.18.1, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.6.1, 0.7.0, 0.8.0, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.3-1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8wv5-x4w7-5gww/GHSA-8wv5-x4w7-5gww.json"
  }
}
    GitHub Advisory Database · GHSA-8wv5-x4w7-5gww · Updated 2026-09-10T12:25:42.392618810Z
  • thrift PyPI

    pkg:pypi/thrift

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.24.0
    17 explicitly listed affected versions

    0.10.0, 0.11.0, 0.13.0, 0.14.0, 0.14.1, 0.14.2, 0.15.0, 0.16.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.8.0, 0.9.0, 0.9.1, 0.9.2, 0.9.3

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/thrift/PYSEC-2026-3926.yaml"
  }
}
    PyPA · PYSEC-2026-3926 · Updated 2026-09-10T12:25:42.392618810Z

Vendor product assessments

  • perl-thrift-0:0.24.0-0.1.hum1@noarch as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • python3-thrift-0:0.24.0-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • python3-thrift-0:0.24.0-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • thrift-0:0.24.0-0.1.hum1@src as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • thrift.src as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • none available: Affected
    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • openshift-update-service/openshift-update-service-rhel8 as a component of Red Hat OpenShift Update Service · known affected

    Vendor assessment for this product only.

    pkg:oci/openshift-update-service-rhel8?repository_url=registry.redhat.io/openshift-update-service/openshift-update-service-rhel8

    • none available: Affected
    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • openshift-sandboxed-containers/osc-podvm-payload-rhel9 as a component of Confidential Compute Attestation · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/osc-podvm-payload-rhel9?repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-podvm-payload-rhel9

    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • conmon-rs as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/conmon-rs

    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • conmon-rs.src as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/conmon-rs?arch=src

    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • kata-containers as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kata-containers

    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00
  • kata-containers.src as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kata-containers?arch=src

    Red Hat · CVE-2026-43871 · Updated 2026-10-02T16:59:54+00:00

Known Affected Software Configurations

VendorProductVersion range
ApacheThrift< 0.24.0

All CVSS metrics

  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 8.7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS