Apache Thrift Java Bindings Uncontrolled Recursion Denial of Service Vulnerability (CVE-2026-120135)
Executive & SecOps Summary
SECOPS ASSESSMENTJava-based applications and services utilizing Apache Thrift versions prior to 0.24.0
Processing maliciously crafted nested messages can trigger a Stack Overflow, leading to an unrecoverable JVM crash and Denial of Service (DoS)
Immediately upgrade the Apache Thrift Java library dependency to version 0.24.0 or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to update the Apache Thrift Java dependency to version 0.24.0 or higher in your build configuration.
For Maven (pom.xml):
<!-- Update dependency in pom.xml -->
<dependency>
<groupId>org.apache.thrift</groupId>
<artifactId>libthrift</artifactId>
<version>0.24.0</version>
</dependency>For Gradle (build.gradle):
// Update dependency in build.gradle
implementation 'org.apache.thrift:libthrift:0.24.0'2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, configure strict limits on message and container sizes using TConfiguration to mitigate the risk of processing excessively large nested payloads.
Example of configuring limits in Java:
import org.apache.thrift.TConfiguration;
// Instantiate TConfiguration with strict limits
TConfiguration config = new TConfiguration();
config.setMaxMessageSize(10485760); // Limit message size to 10MB
// Additionally, restrict network access to the Thrift RPC ports using firewalls or security groups to trusted IPs only.3. Log Audit & IoC Verification Commands
Monitor application logs for unexpected JVM crashes and stack traces indicating recursion issues within the Thrift library.
Search application logs for Thrift-related StackOverflow errors:
# Search for StackOverflowError associated with Apache Thrift in log files
grep -ri 'java.lang.StackOverflowError' /var/log/apps/ | grep -i 'thrift'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-120135) is an uncontrolled recursion flaw (CWE-674) residing in the Apache Thrift Java bindings. Apache Thrift is a widely adopted framework for scalable cross-language services development. The root cause lies in the Java binding's deserialization engine, which lacks sufficient depth validation when parsing deeply nested structures (such as nested lists, maps, or structs).
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by transmitting a specially crafted Thrift message containing deeply nested container structures. When the target Java application attempts to deserialize this payload, the parser recursively invokes its internal parsing routines. Because there is no enforcement of a maximum recursion depth limit, the call stack is quickly exhausted, triggering a java.lang.StackOverflowError which terminates the JVM process and results in a complete Denial of Service (DoS).
3. Infrastructure & Business Impact
With a CVSS 4.0 score of 8.2 (High), this vulnerability poses a significant threat to service availability. Since no authentication is required to trigger the crash, an attacker can easily disrupt critical backend microservices or data ingestion pipelines. In distributed architectures where Thrift is used for internal RPC, a single crash can propagate and cause cascading failures across the entire infrastructure.
Official Vendor Advisories & References
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Frequently Asked SecOps Questions (CVE-2026-120135)
FAQQ1. How critical is CVE-2026-120135 and is it actively exploited in the wild?
CVE-2026-120135 is rated CVSS 8.2 (HIGH) with a 30-day EPSS exploitation probability of 0.5%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120135?
Primary impacted vendors include apache across thrift. Scope summary: All versions of Apache Thrift Java bindings prior to 0.24.0
Q3. What temporary mitigations or workarounds exist for CVE-2026-120135 before patching?
[Mitigation] Immediately upgrade the Apache Thrift Java library dependency to version 0.24.0 or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120135
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.