CVE-2026-120135

The Apache Thrift Java bindings versions before 0.24.0 are vulnerable to an uncontrolled recursion vulnerability in the TProtocolUtil.skip() method. The root cause is that the method does not limit recursion depth by default, which can lead to a high availability impact (as indicated by the CVSS ...