CVE-2026-120135: unbounded recursion by default in Apache Thrift Java TProtocolUtil.skip()

What happened and what to do

The Apache Thrift project advisory, published on 30 October 2026 by Jens Geyer, describes CVE-2026-120135. In the Java bindings, the TProtocolUtil.skip() method does not limit recursion depth by default when traversing nested structures, which can lead to uncontrolled resource consumption and unavailability. Versions of libthrift (org.apache.thrift:libthrift) earlier than 0.24.0 are affected, and 0.24.0 fixes the problem. The severity was rated important, with CVSS 4.0 of 8.2, network attack vector, low complexity, no privileges and no user interaction, with high impact on availability only.

In practice, a company should start by mapping where libthrift is used across its Java services, including transitive dependencies in Maven and Gradle builds, and which endpoints receive Thrift payloads from untrusted sources. Then it should plan the upgrade to 0.24.0 with regression tests in staging. Until the upgrade ships, size and depth limits can be enforced at the gateway or edge for incoming messages, and stack, memory, CPU and stack overflow errors can be monitored per service, with alerts on abnormal spikes. A controlled test with nested payloads in staging helps confirm behaviour before and after the fix.

How the consultancy can help

Exposure diagnosis: a survey of Java applications using libthrift, the entry points that receive external data, and the versions in production. Then a scoped proposal to upgrade to 0.24.0, with regression tests, edge limits and availability monitoring.

Next step

If your team uses Apache Thrift in Java services, send a short description of your case, including the versions in use and where data arrives from outside. Wendelmaques will reply with a scoped proposal for the diagnosis and the fix.