CVE-2026-83663: 
Grafana Análise e mitigação de vulnerabilidades

CVE-2026-83663 is an Uncontrolled Recursion vulnerability in the Apache Thrift Go language bindings that allows unauthenticated remote attackers to crash the entire Go process, resulting in a denial of service. It affects all versions of Apache Thrift before 0.25.0 (specifically the github.com/apache/thrift Go module). The vulnerability was published on October 2, 2026, with a patch available in version 0.25.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) combined with unbounded resource allocation (CWE-770) in two Go transport implementations: TFramedTransport and THeaderTransport. When either transport reads a buffered frame that yields zero payload bytes — achievable with just 4 bytes for TFramedTransport (a declared frame size of zero) or 18 bytes for THeaderTransport (a header block filling the entire frame) — the transport calls Read() recursively rather than looping, with no depth limit. This recursion continues until the Go runtime's stack limit is exhausted, triggering a fatal error that cannot be intercepted by recover(), causing the entire process to terminate. The attack requires no authentication and is network-accessible, making it trivially automatable (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a complete denial of service: the targeted Go process running an Apache Thrift service crashes entirely and cannot recover, as the fatal stack exhaustion error bypasses Go's standard error-handling mechanisms. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any service built on the affected Go Thrift bindings is vulnerable, and a single malicious peer sending a minimal crafted frame can take down the entire service process (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). However, the attack is highly automatable — NVD SSVC data confirms automatable: yes — requiring only a minimal crafted network frame (4 or 18 bytes) sent to any exposed Thrift service endpoint with no authentication required. The EPSS score is 0.0, reflecting no current exploitation activity. The CVE status is listed as "Deferred" and it has not been added to the CISA KEV catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify services exposing Apache Thrift endpoints over the network using port scanning tools (e.g., Nmap, Shodan) targeting common Thrift ports (e.g., 9090, 9091) and confirming Go-based Thrift service banners or behaviors.
2. Determine transport type: Probe the target to determine whether it uses TFramedTransport or THeaderTransport, which can often be inferred from service configuration or response framing behavior.
3. Craft malicious frame: For TFramedTransport, construct a 4-byte frame with a declared payload size of zero. For THeaderTransport, construct an 18-byte frame consisting entirely of a header block with no payload data.
4. Send crafted frame: Transmit the malicious frame to the target Thrift service endpoint over TCP. No authentication or session establishment is required.
5. Trigger unbounded recursion: The transport's Read() method receives the empty-payload frame and recursively calls itself without looping, exhausting the Go runtime stack.
6. Process crash: The Go runtime raises a fatal error due to stack overflow, which recover() cannot catch, causing the entire service process to terminate and resulting in complete service unavailability (GitHub Advisory, Red Hat Bugzilla).

• Network: Inbound TCP connections to Thrift service ports (e.g., 9090, 9091) sending very small frames (4 bytes for TFramedTransport or 18 bytes for THeaderTransport) followed immediately by connection termination; repeated connection attempts from the same source IP targeting the Thrift port.
• Logs: Go runtime fatal error: stack overflow or goroutine stack exceeds messages in application logs or system journal immediately before process exit; abrupt service termination without a graceful shutdown log entry.
• Process: Unexpected termination of the Go-based Thrift service process (e.g., process exit code indicating a fatal signal); process supervisor (systemd, Kubernetes, etc.) logs showing repeated service restarts correlated with inbound network activity.

The primary remediation is to upgrade the Apache Thrift Go bindings (github.com/apache/thrift) to version 0.25.0 or later, which resolves the unbounded recursion by replacing the recursive Read() calls with iterative loops (GitHub Advisory). As a temporary workaround until patching is complete, restrict network access to Thrift service endpoints to trusted peers only using firewall rules or network segmentation, and consider implementing rate limiting or connection throttling on the Thrift service to reduce exposure. Organizations using Red Hat products that bundle the affected Go Thrift library should monitor the Red Hat Bugzilla entry for downstream patch availability (Red Hat Bugzilla).