Apache Thrift: uncontrolled recursion

Apache Thrift

Apache Thrift Java bindings have an uncontrolled recursion vulnerability, affecting versions before 0.24.0. Upgrade to 0.24.0 to fix the issue.

Do this now

Upgrade Apache Thrift to 0.24.0 or later, since earlier versions are affected by the uncontrolled recursion flaw.

Fix it

Upgrade to Apache Thrift 0.24.0

First seen: 31 Oct 2026
Last update: 31 Oct 2026, 02:17 UTC
Fixed in: 0.24.0
Identifiers: CVE-2026-120135 ID not published yet
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Thrift: uncontrolled recursion
Severity: unknown. Patch status: patched.
Affected: Apache Thrift
Fixed in: 0.24.0
Ids: CVE-2026-120135

Apache Thrift Java bindings have an uncontrolled recursion vulnerability, affecting versions before 0.24.0. Upgrade to 0.24.0 to fix the issue.

## Steps
1. Search the repo, its CI and infra config for Apache Thrift. If present, report the version in use and whether it's affected.
2. Fix by release line: Apache Thrift: 0.24.0.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Apache Thrift | fixed | 0.24.0 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-120135") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/456
https://pwned.coffee/i/apache-thrift-uncontrolled-recursion-cve-2026-120135

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Apache Thrift before 0.24.0 0.24.0 Reported checked 31 Oct
Score: No CVSS published yet: severity unknown.
Last checked: 31 Oct 2026, 04:18 UTC

Product	Affected	Fixed in	Source
Apache Thrift	before 0.24.0	0.24.0	Reported checked 31 Oct

Sources: KEV – CVE record – Vendor –

Sources

seclists.org: CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone coffee