AIKIDO-2026-630774
thrift is vulnerable to Heap-based Buffer Overflow
92
Critical Risk
This Affects:
thriftTL;DR
THttpTransport::refill() in the C++ HTTP transport doubles httpBufSize_ whenever an HTTP request or response line does not fit, with no ceiling on that growth. A peer that withholds the terminating CRLF can force the buffer to keep doubling until the process exhausts memory, and once httpBufSize_ reaches 2 GiB the next doubling wraps the uint32_t so realloc() shrinks the buffer that the following read overflows. The fix adds maxHttpBufSize(), which limits growth to TConfiguration's configured maximum message size and throws a TTransportException when that limit is reached.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the C++ THttpServer or THttpClient transport to read HTTP-framed Thrift traffic from a peer that can omit the terminating CRLF.
Background info
thrift is vulnerable to Heap-based Buffer Overflow in versions 0.2.0 - 0.24.0.
How to fix this
Upgrade the thrift library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.