Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to v…

A heap-based buffer overflow vulnerability has been identified in Apache Thrift's C++ bindings, tracked as CVE-2026-55971. The vulnerability affects all versions of Apache Thrift prior to 0.24.0. Heap-based buffer overflows can lead to arbitrary code execution, denial of service, or memory corruption depending on how the overflow is triggered. Users and organizations relying on Apache Thrift C++ bindings are strongly advised to upgrade to version 0.24.0, which contains the fix. The vulnerability was disclosed via Apache mailing lists and the Openwall security list. No specific exploitation details or active exploitation in the wild have been noted in the advisory. The fix is straightforward: upgrading to the patched release resolves the issue entirely.