CVE-2026-83663

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a loop, exhausting the execution stack. This stack exhaustion causes an unrecoverable fatal error that terminates the entire process.