Description
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Thrift | < 0.24.0 | 0.24.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thrift | 0.24.0-2 | — |
| Debian 13 | thrift | No fix yet | — |
| Debian 12 | thrift | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | thrift +1 | No fix yet | — |
| Ubuntu 26.04 LTS | thrift +1 | No fix yet | — |
| Ubuntu 24.04 LTS | thrift +1 | No fix yet | — |
| Ubuntu 22.04 LTS | thrift +1 | No fix yet | — |
| Ubuntu 20.04 LTS | thrift | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libthrift-java | No fix yet | — |
| Ubuntu 16.04 LTS | libthrift-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | thrift +5 | 0.24.0-0.1.hum1 | RHSA-2026:49837 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | thrift | 0.24.0-1.1 | openSUSE-SU-2026:11432-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | influxdb | 2.7.5-20 | — |
| Azure Linux 3 | kata-containers-cc | 3.15.0.aks0-20 | — |
| Azure Linux 3 | kata-containers-preview | No fix yet | — |
| Azure Linux 3 | telegraf | 1.31.0-26 | — |
| Azure Linux 3 | thrift | 0.24.0-1 | — |
| Azure Linux 3 | vitess | 19.0.4-12 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | amazon-cloudwatch-agent | 1.300072.0-r6 | — |
| Wolfi rolling | bento | 1.21.1-r3 | — |
| Wolfi rolling | datadog-agent-7.80-full | 7.80.4-r14 | — |
| Wolfi rolling | datadog-agent-7.80-oci-compat +2 | 7.80.4-r16 | — |
| Wolfi rolling | druid | 38.0.0-r8 | — |
| Wolfi rolling | grafana-12.3 | 12.3.11-r5 | — |
| Wolfi rolling | grafana-12.4 | 12.4.10-r1 | — |
| Wolfi rolling | grafana-13.0 | 13.0.8-r1 | — |
| Wolfi rolling | jaeger-2 +1 | 2.21.0-r0 | — |
| Wolfi rolling | jaeger-2-jaeger +1 | 2.20.0-r9 | — |
| Wolfi rolling | jitsucom-bulker-bulker +1 | 2.15.0-r2 | — |
| Wolfi rolling | jitsucom-bulker-sidecar-compat | 2.15.0-r4 | — |
| Wolfi rolling | kserve-modelmesh +4 | No fix yet | — |
| Wolfi rolling | minio | 0.20260717.120751-r12 | — |
| Wolfi rolling | nri-cassandra +1 | 2.23.1-r1 | — |
| Wolfi rolling | nri-jmx +1 | 3.17.0-r1 | — |
| Wolfi rolling | nri-kafka +1 | 3.24.0-r0 | — |
| Wolfi rolling | seaweedfs | 4.45-r3 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.5-r1 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.4-r2 | — |
| Wolfi rolling | tempo-2.10 +1 | 2.10.8-r3 | — |
| Wolfi rolling | tempo-3.0 +3 | 3.0.3-r4 | — |
| Wolfi rolling | temporal | 1.8.3-r1 | — |
| Wolfi rolling | wavefront-proxy | 13.9-r27 | — |
| Wolfi rolling | zipkin | 3.6.1-r24 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/apache/thrift | < 0.24.0 | 0.24.0 | GHSA-8wv5-x4w7-5gww |
| Maven | org.apache.thrift:libthrift | < 0.24.0 | 0.24.0 | GHSA-8wv5-x4w7-5gww |
| Packagist | apache/thrift | < 0.24.0 | 0.24.0 | GHSA-8wv5-x4w7-5gww |
| PyPI | thrift | < 0.24.0 | 0.24.0 | PYSEC-2026-3926 |
Advisories 3
- WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- RHSA-2026:49837 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:11432-1 libthrift-0_24_0-0.24.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 2, 2026
References
- https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 vendor-advisory
- https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby vendor-advisory