CVE-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-58389

CVE-2026-58389 affects Apache Thrift before 0.24.0, specifically the Rust binary protocol non-strict path handling. The root cause is an allocation of resources without limits or throttling in the Rust bindings, which can lead to uncontrolled resource consumption. The practical impact is high ava...