CVE-2026-43871
Full vulnerability record from the local CVENow database.
Description
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-27 12:16:44.413000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-43871",
"sourceIdentifier": "[email protected]",
"published": "2026-07-27T12:16:44.413",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue."
},
{
"lang": "es",
"value": "Vulnerabilidad de ’Bucle con condición de salida inalcanzable’ (’Bucle infinito’) en los enlaces de Apache Thrift para Python, Go, PHP y Java. Este problema afecta a Apache Thrift: antes de la versión 0.24.0.\n\nSe recomienda a los usuarios actualizar a la versión 0.24.0, que corrige el problema."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"defaultStatus": "unaffected",
"collectionURL": "https://pypi.python.org",
"packageName": "thrift",
"versions": [
{
"version": "0",
"lessThan": "0.24.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"defaultStatus": "unaffected",
"collectionURL": "https://proxy.golang.org",
"packageName": "github.com/apache/thrift",
"versions": [
{
"version": "0",
"lessThan": "0.24.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"defaultStatus": "unaffected",
"collectionURL": "https://packagist.org",
"packageName": "apache/thrift",
"versions": [
{
"version": "0",
"lessThan": "0.24.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Apache Software Foundation",
"product": "Apache Thrift",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.thrift:libthrift",
"versions": [
{
"version": "0",
"lessThan": "0.24.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-27T13:01:27.166234Z",
"id": "CVE-2026-43871",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-835"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.24.0",
"matchCriteriaId": "D4BC4964-13B2-4F51-8357-029729215133"
}
]
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/33",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
}
]
}