GitHub Advisoryadvisory · PyPI, Go, Packagist, Maven

GHSA-8wv5-x4w7-5gww Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

HIGH Published 2026-07-27 Modified 2026-09-02 Official page ↗
Aliases
CVE-2026-43871
Ecosystem
PyPI, Go, Packagist, Maven
Packages
thrift, github.com/apache/thrift, apache/thrift, org.apache.thrift:libthrift
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2026-09-02

Affected packages

• PyPI thrift: < 0.24.0 → fixed in 0.24.0 • Go github.com/apache/thrift: < 0.24.0 → fixed in 0.24.0 • Packagist apache/thrift: < 0.24.0 → fixed in 0.24.0 • Maven org.apache.thrift:libthrift: < 0.24.0 → fixed in 0.24.0

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-43871 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References