CVE-2026-58662: 
Apache Thrift vulnerability analysis and mitigation

CVE-2026-58662 is an Improper Validation of Specified Quantity in Input and Out-of-bounds Read vulnerability affecting the C++ bindings of Apache Thrift. It affects all versions of Apache Thrift before 0.24.0 and was publicly disclosed on July 24, 2026, with NVD publication on July 27, 2026. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.7 (High) (Apache Advisory, GitHub Advisory).

The vulnerability is rooted in insufficient validation of length or quantity fields when processing input data in Apache Thrift's C++ bindings, specifically identified as affecting the THeaderTransport::readString() function's info-header length bounds checking (CWE-125: Out-of-bounds Read; CWE-1284: Improper Validation of Specified Quantity in Input). An unauthenticated remote attacker can send a specially crafted Thrift protocol message with a manipulated length field, causing the C++ runtime to read memory beyond the intended buffer boundary. No authentication, user interaction, or special privileges are required to trigger the flaw, and exploitation is considered automatable (Apache Advisory, GitHub Advisory).

Successful exploitation can result in two primary consequences: disclosure of sensitive memory contents from the affected Thrift C++ process (confidentiality impact) and a crash of the service (availability impact). Because the out-of-bounds read can expose arbitrary process memory, sensitive data such as credentials, session tokens, or business logic data processed by the service may be leaked to an unauthenticated attacker. Integrity is not directly impacted, but service disruption through repeated crashes could affect dependent systems and downstream services (Apache Advisory, GitHub Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 1.15% (64th percentile), indicating a moderate relative probability of exploitation within 30 days. The attack is network-accessible, requires no authentication, and is classified as automatable, which lowers the barrier for potential future exploitation (GitHub Advisory).

1. Reconnaissance: Identify services exposing Apache Thrift C++ endpoints over the network using port scanning tools (e.g., Nmap, Shodan) targeting common Thrift ports (e.g., 9090, 9091) and fingerprinting the Thrift protocol.
2. Craft malicious Thrift message: Construct a Thrift protocol message (e.g., using the binary or compact protocol) targeting the THeaderTransport layer, with a manipulated or oversized length field in the info-header section to bypass bounds validation in readString().
3. Send crafted payload: Transmit the malformed Thrift message to the target service without any authentication credentials, as no privileges are required.
4. Trigger out-of-bounds read: The vulnerable C++ binding reads beyond the allocated buffer, potentially returning memory contents in an error response or causing the service to crash.
5. Collect leaked data or confirm DoS: Analyze any response data for sensitive memory contents (e.g., heap data, credentials), or confirm denial of service by observing service unavailability (Apache Advisory, GitHub Advisory).

• Network: Unusual or malformed Thrift protocol messages arriving on Thrift service ports (commonly TCP 9090/9091) with anomalously large or invalid length fields in the header; repeated connection attempts from a single external IP to Thrift endpoints.
• Logs: Application logs showing repeated parsing errors, buffer read exceptions, or crashes in the Thrift C++ transport layer (e.g., THeaderTransport errors); unexpected service restarts or crash dumps from the Thrift server process.
• Process: Thrift server process terminating unexpectedly or generating core dump files; elevated memory read errors reported by OS-level monitoring tools.
• File System: Presence of core dump files (e.g., core.*) in the working directory of the Thrift service process following unexpected crashes.

The primary remediation is to upgrade Apache Thrift to version 0.24.0 or later, which contains the fix for this vulnerability (Apache Advisory). As an interim workaround where immediate upgrade is not feasible, restrict network access to Thrift C++ services to trusted clients only using firewall rules or network segmentation. Downstream distributions including Debian and openSUSE have also begun packaging the patched version, and Red Hat has issued an errata (RHSA-2026:52829) for affected products.

The vulnerability was announced on the Apache security mailing list and the oss-security list on July 24, 2026, and received coverage on security aggregation platforms including Vulners, VulDB, and CIRCL shortly after NVD publication. A Bluesky post from the infosec community noted the disclosure within hours of the announcement. Microsoft acknowledged the vulnerability in its Security Response Center advisory. No major vendor statements beyond Apache's own advisory or significant researcher deep-dives have been publicly identified at this time (Apache Advisory, Microsoft).