CVE-2026-43871: apache software foundation apache thrift Infinite Loop

CVSS: 8.7v4.0HighAnalyzed

AliasesGHSA-8wv5-x4w7-5gwwBIT-thrift-2026-43871PYSEC-2026-3926+345 more

Published 27-07-2026Last modified 27-07-2026

Vulnerability summary

CVE-2026-43871 is a high (CVSS 8.7) Infinite Loop vulnerability in apache software foundation apache thrift. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63% of scored vulnerabilities.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.7/10

010

High · v4.0 (CVE.org)

EPSS score

1.03%

0%100%

Low · +0.42 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2026:11432-1 RHSA-2026:49837 CGA-6RH3-C73W-X6C9

Timeline

27-07-2026
PublishedVulnerability first disclosed.
27-07-2026
Last modifiedVulnerability information updated.

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS metrics

14 scores · 9 sources · 2 versions

v4.08.7v3.17.5

EPSS trend

Probability

1.03%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

+0.42 pp

From 0.61% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.03%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected systems

Chainguard172 products

agentbeat< 9.2.7-r27
agentbeat-fips< 9.2.7-r25
amazon-cloudwatch-agent< 1.300073.0-r1 | < 1.300072.0-r6
amazon-cloudwatch-agent-fips< 1.300072.0-r5
apm-server-8.19< 8.19.21-r2

apm-server-fips-8.19< 8.19.21-r1
automq< 1.7.4-r1 | All versions (No fix recorded)
automq-fips< 1.7.4-r1 | All versions (No fix recorded)
bento< 1.21.1-r3
bento-fips< 1.21.1-r6
cadence< 1.4.1-r11
cadence-cassandra-tool< 1.4.1-r11
cadence-fips< 1.4.1-r11
cadence-fips-cassandra-tool< 1.4.1-r11
cadence-fips-server< 1.4.1-r11
cadence-fips-sql-tool< 1.4.1-r11
cadence-server< 1.4.1-r11
cadence-sql-tool< 1.4.1-r11
commercial-expanso-edgeAll versions (No fix recorded)
commercial-grafana-11.6All versions (No fix recorded)
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2All versions (No fix recorded)
commercial-grafana-12.3All versions (No fix recorded)
commercial-grafana-12.4< 12.4.12-r0
commercial-grafana-13.0< 13.0.10-r0
commercial-grafana-13.1< 13.1.7-r0
commercial-grafana-13.2< 13.2.3-r0
dapr-daprd-1.15< 1.15.14-r15 | < 1.15.14-r16
dapr-daprd-fips-1.15All versions (No fix recorded) | < 1.15.14-r17
datadog-agent-7.76-fullAll versions (No fix recorded)
datadog-agent-7.77-fullAll versions (No fix recorded)
datadog-agent-7.78-fullAll versions (No fix recorded)
datadog-agent-7.79-fullAll versions (No fix recorded)
datadog-agent-7.80-core-integrations< 7.80.4-r16
datadog-agent-7.80-full< 7.80.4-r14
datadog-agent-7.80-oci-compatAll versions (No fix recorded)
datadog-agent-7.80-s6-overlay< 7.80.4-r16
datadog-agent-7.81-fullAll versions (No fix recorded)
datadog-agent-7.82-fullAll versions (No fix recorded)
datadog-agent-fips-7.76-fullAll versions (No fix recorded)
datadog-agent-fips-7.77-full< 7.77.3-r32
datadog-agent-fips-7.78-fullAll versions (No fix recorded)
datadog-agent-fips-7.79-fullAll versions (No fix recorded)
datadog-agent-fips-7.80-fullAll versions (No fix recorded)
datadog-agent-fips-7.81-fullAll versions (No fix recorded)
datadog-agent-fips-7.82-fullAll versions (No fix recorded)
druidAll versions (No fix recorded)
elastic-agent-9.2< 9.2.8-r22
elastic-agent-fips-9.2< 9.2.8-r17
elastic-otel-collector-9.3< 9.3.8-r6
elastic-otel-collector-fips-9.3All versions (No fix recorded)
filebeat-9.2< 9.2.8-r29
filebeat-9.3< 9.3.8-r12
filebeat-fips-9.2All versions (No fix recorded)
filebeat-fips-9.3< 9.3.8-r7
grafana-11.6All versions (No fix recorded)
grafana-12.1< 12.1.10.01-r22
grafana-12.2All versions (No fix recorded)
grafana-12.3< 12.3.11-r5
grafana-12.4< 12.4.10-r1
grafana-13.0< 13.0.8-r1
grafana-13.1< 13.1.4-r5
grafana-13.2< 13.2.1-r3
grafana-fips-11.6< 11.6.16-r14
grafana-fips-12.1< 12.1.10.01-r12
grafana-fips-12.2All versions (No fix recorded)
grafana-fips-12.3All versions (No fix recorded)
grafana-fips-12.4< 12.4.10-r3
grafana-fips-13.0< 13.0.8-r1
grafana-fips-13.1< 13.1.5-r2
grafana-fips-13.2< 13.2.1-r3
grafana-geomys-fips-13.1< 13.1.5-r1
jaeger-1-all-in-oneAll versions (No fix recorded)
jaeger-1-collectorAll versions (No fix recorded)
jaeger-1-fips-all-in-oneAll versions (No fix recorded)
jaeger-1-fips-collectorAll versions (No fix recorded)
jaeger-1-fips-ingesterAll versions (No fix recorded)
jaeger-1-fips-queryAll versions (No fix recorded)
jaeger-1-ingesterAll versions (No fix recorded)
jaeger-1-queryAll versions (No fix recorded)
jaeger-2< 2.21.0-r0
jaeger-2-all-in-one-compatAll versions (No fix recorded)
jaeger-2-fips-jaeger< 2.20.0-r8
jaeger-2-fips-queryAll versions (No fix recorded)
jaeger-2-jaeger< 2.20.0-r9
jaeger-2-jaeger-compatAll versions (No fix recorded)
jaeger-2-remote-storage< 2.20.0-r9
jitsucom-bulker-bulker< 2.15.0-r2
jitsucom-bulker-sidecar< 2.15.0-r2
jitsucom-bulker-sidecar-compat< 2.15.0-r4
kserve-modelmeshAll versions (No fix recorded)
milvus-2.5< 2.5.27-r28
milvus-2.6< 2.6.23-r3
milvus-3.0< 3.0.0-r8
minio< 0.20260717.120751-r12
minio-fips< 0.20260717.120751-r8
nri-cassandra< 2.23.1-r1
nri-cassandra-fips< 2.23.1-r3
nri-cassandra-jdk11< 2.23.1-r1
nri-jmx< 3.17.0-r1
nri-jmx-fips< 3.17.0-r0
nri-jmx-jdk11< 3.17.0-r1
nri-kafka< 3.24.0-r0
nri-kafka-fips< 3.24.0-r2
nri-kafka-jdk11< 3.24.0-r0
nuxeo-2023< 2023.45-r13
plutono< 7.5.50-r10
plutono-fips< 7.5.50-r9
rangerAll versions (No fix recorded)
seaweedfs< 4.45-r3
seaweedfs-fips< 4.45-r3
seaweedfs-rocksdb< 4.45-r2
seaweedfs-rocksdb-fips< 4.45-r4
solr-9-full< 9.10.1-r14
solr-fips-9-full< 9.10.1-r2
spark-3.5-scala-2.12All versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-4.0-scala-2.13All versions (No fix recorded)
spark-4.1-scala-2.13All versions (No fix recorded)
spark-4.2-scala-2.13All versions (No fix recorded)
spark-fips-3.5-scala-2.12All versions (No fix recorded)
spark-fips-3.5-scala-2.13All versions (No fix recorded)
spark-fips-4.1-scala-2.13All versions (No fix recorded)
spark-fips-4.2-scala-2.13All versions (No fix recorded)
telegraf-1.36< 1.36.4-r17
telegraf-1.37All versions (No fix recorded)
tempo-2.10< 2.10.8-r3
tempo-2.10-query< 2.10.8-r3
tempo-2.8< 2.8.4-r17
tempo-2.8-cli< 2.8.4-r17
tempo-2.8-query< 2.8.4-r17
tempo-2.8-vulture< 2.8.4-r17
tempo-2.9< 2.9.5-r4
tempo-2.9-cli< 2.9.5-r4
tempo-2.9-query< 2.9.5-r4
tempo-2.9-vulture< 2.9.5-r4
tempo-3.0< 3.0.3-r6 | < 3.0.3-r4
tempo-3.0-cli< 3.0.3-r4
tempo-3.0-query< 3.0.3-r4
tempo-3.0-vulture< 3.0.3-r4 | < 3.0.3-r6
tempo-fips-2.10< 2.10.8-r2
tempo-fips-2.10-cli< 2.10.8-r2
tempo-fips-2.10-query< 2.10.8-r2
tempo-fips-2.10-vulture< 2.10.8-r2
tempo-fips-2.8< 2.8.4-r10
tempo-fips-2.8-cli< 2.8.4-r10
tempo-fips-2.8-query< 2.8.4-r10
tempo-fips-2.8-vulture< 2.8.4-r10
tempo-fips-2.9< 2.9.5-r3
tempo-fips-2.9-cli< 2.9.5-r3
tempo-fips-2.9-query< 2.9.5-r3
tempo-fips-2.9-vulture< 2.9.5-r3
tempo-fips-3.0< 3.0.3-r2
tempo-fips-3.0-cli< 3.0.3-r2
tempo-fips-3.0-query< 3.0.3-r2
tempo-fips-3.0-vulture< 3.0.3-r2
temporal< 1.8.3-r1
temporal-fips< 1.8.3-r1
temporal-server-1.29< 1.29.7-r8
temporal-server-1.30< 1.30.6-r9
temporal-server-1.31< 1.31.2-r8
temporal-server-fips-1.29< 1.29.7-r6
temporal-server-fips-1.30< 1.30.6-r7
temporal-server-fips-1.31< 1.31.2-r7
vault-1.21< 1.21.4-r16
vault-2.0< 2.0.4-r3
vault-2.1< 2.1.0-r2
vault-fips-1.21All versions (No fix recorded)
vault-fips-2.0< 2.0.4-r2
vault-fips-2.1< 2.1.0-r2
wavefront-proxy< 13.9-r27
zipkin< 3.6.1-r24

Show all 172

Wolfi26 products

amazon-cloudwatch-agent< 1.300073.0-r1 | < 1.300072.0-r6
bento< 1.21.1-r3
datadog-agent-7.77-fullAll versions (No fix recorded)
datadog-agent-7.78-fullAll versions (No fix recorded)
datadog-agent-7.79-fullAll versions (No fix recorded)

Show all 26

Apache1 product

thrift< 0.24.0

Apache software foundation1 product

apache thrift< 0.24.0

4 vendors · 200 products · Showing 200 of 225. Use Open JSON for the complete list.

References

15 links

lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9Vendor AdvisoryWEBAdvisoryRelease Notes
lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qbyVendor AdvisoryWEBAdvisory
www.openwall.com/lists/oss-security/2026/07/24/33WEBMailing ListThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2026-43871AdvisoryOval
github.com/apache/thriftPACKAGE
pypi.org/project/thriftPACKAGE
github.com/advisories/GHSA-8wv5-x4w7-5gwwAdvisory
ubuntu.com/security/CVE-2026-43871REPORT
www.cve.org/CVERecord?id=CVE-2026-43871REPORT
security-tracker.debian.org/tracker/CVE-2026-43871Advisory

Show all 15 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities