AIKIDO-2026-742055
thrift is vulnerable to Denial of Service (DoS)
82
High Risk
This Affects:
thriftTL;DR
TJSONProtocol.readMapBegin and readListBegin take a map or list size from the JSON payload and use it without checking that it matches the elements actually present. Code that later trusts that size can allocate or iterate far past the real payload. The fix calls checkContainerSize so a declared size cannot exceed the elements that were parsed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you deserialize untrusted Thrift JSON messages that contain maps or lists.
Background info
thrift is vulnerable to Denial of Service (DoS) in versions 0.9.3 - 0.24.0.
How to fix this
Upgrade the thrift library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.