CVE-2026-58389: 
Apache Thrift vulnerability analysis and mitigation

CVE-2026-58389 is an Allocation of Resources Without Limits or Throttling vulnerability in the Apache Thrift Rust bindings, specifically affecting the binary protocol non-strict path due to a missing string size limit. It affects all versions of Apache Thrift before 0.24.0 and was publicly disclosed on July 24, 2026, by Jens Geyer via the oss-security mailing list, with credit to finder Javid Khan. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the Rust binary protocol implementation in Apache Thrift lacks a size limit on string allocations in its non-strict deserialization path, allowing unbounded memory allocation. An unauthenticated remote attacker can exploit this by sending specially crafted Thrift binary protocol messages containing oversized string fields, causing the server to allocate excessive memory without restriction. No authentication or user interaction is required, and the attack complexity is low, making it straightforward to automate (oss-security, GitHub Advisory).

Successful exploitation results in a denial-of-service condition by exhausting server memory, CPU, or connection resources, rendering the Apache Thrift service unavailable or unresponsive. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Services and applications built on Apache Thrift Rust bindings are directly affected, and prolonged exploitation could cause cascading failures in dependent microservices or distributed systems (GitHub Advisory, Apache Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 1.097% (62nd percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies the attack as automatable with partial technical impact (GitHub Advisory).

1. Reconnaissance: Identify services exposing Apache Thrift endpoints (particularly those using Rust bindings) via network scanning tools such as Nmap or Shodan, targeting common Thrift ports (e.g., 9090, 9091).
2. Craft malicious payload: Construct a Thrift binary protocol message using the non-strict path that includes an extremely large string field (e.g., declaring a string length of several gigabytes without a corresponding size limit check).
3. Send the payload: Transmit the crafted message to the target Thrift service endpoint without any authentication, leveraging the network-accessible attack vector.
4. Trigger resource exhaustion: The server attempts to allocate memory for the declared string size without enforcing limits, consuming available memory and/or CPU until the service becomes unresponsive or crashes.
5. Sustain the attack: Repeat or parallelize requests to maintain the denial-of-service condition (oss-security, GitHub Advisory).

• Network: Unusual high-volume or repeated connections to Thrift service ports (e.g., 9090, 9091) from a single or small set of source IPs; abnormally large inbound Thrift binary protocol messages.
• Logs: Application logs showing repeated deserialization errors or out-of-memory panics in the Rust Thrift service process; sudden spikes in connection counts from specific clients.
• Process/System: Rapid memory consumption by the Thrift server process leading to OOM (out-of-memory) killer events; increased CPU usage associated with allocation attempts; service crashes or restarts logged by the process supervisor (e.g., systemd, Docker).

The primary remediation is to upgrade Apache Thrift to version 0.24.0 or later, which introduces string size limits in the Rust binary protocol non-strict path (Apache Advisory). As a temporary workaround prior to patching, operators should implement network-level rate limiting and resource quotas on Thrift service endpoints to restrict per-client resource consumption. Additionally, placing Thrift services behind a reverse proxy or API gateway with request size limits can reduce exposure. OpenSUSE has also issued a security announcement for downstream package updates (openSUSE Security).

The vulnerability was announced on the oss-security mailing list and the Apache announcements list on July 24, 2026, with standard community acknowledgment. Social media activity was limited, with brief mentions on Bluesky and Mastodon by security aggregator accounts such as RedPacketSecurity. Downstream distributors including Debian and openSUSE have initiated packaging updates for Apache Thrift 0.24.0 in response to the advisory (oss-security, openSUSE Security).