vulnerabilityCVE-2026-66331

Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Severity

6.9Medium

Exploitation evidence

None confirmed

Remediation

Fixed in 0.25.0

Affected software

Software	Affected versions	Fixed in	Sources

CVSS (Common Vulnerability Scoring System)

Preferred assessment

Vector

Attack vector

Attack complexity

Privileges required

User interaction

Scope

Confidentiality impact

Integrity impact

Availability impact

Source assessments

EPSS (Exploit Prediction Scoring System)

Probability

Percentile

Model

Preferred remediation

Action