CVE-2026-120135 Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-120135

The Apache Thrift Java bindings versions before 0.24.0 are vulnerable to an uncontrolled recursion vulnerability in the TProtocolUtil.skip() method. The root cause is that the method does not limit recursion depth by default, which can lead to a high availability impact (as indicated by the CVSS ...

BIT-THRIFT-2026-85493 Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the TProtocolUtil.skip process. An attacker can cause excessive resource consumption or application crash by sending data with deeply nested structures. Remediation Upgrade org.apache.thrift:thrift to version...

thrift: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)

A flaw was found in Apache Thrift's Dart and Java ME bindings. A remote unauthenticated attacker can exploit this flaw by sending specially crafted requests that trigger excessive recursion. This condition can exhaust system resources and crash the application, resulting in a Denial of Service Do...

PT-2026-37330

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=506318134 Crash type: Security exception Crash state: org.apache.thrift.protocol.TProtocolUtil.skip org.apache.thrift.protocol.TCompactProtocol.readByte org.apache.thrift.protocol.TCompactProtocol.readFieldBegin...

thrift-java:ParseCompactFuzzer: Security exception in org.apache.thrift.protocol.TProtocolUtil.skip

Detailed Report: https://oss-fuzz.com/testcase?key=6326522100383744 Project: thrift-java Fuzzing Engine: libFuzzer Fuzz Target: ParseCompactFuzzer Job Type: libfuzzerasanthrift-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...