PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-120135 Apache Software Foundation CVE debrief

CVE-2026-120135 is an Uncontrolled Recursion vulnerability affecting Apache Thrift Java bindings. The issue exists in versions before 0.24.0 and is fixed in version 0.24.0. Users should upgrade to the fixed version to mitigate the vulnerability. The vulnerability may lead to potential denial of service due to uncontrolled recursion. Details on exploitation or impact are limited, and verification of affected systems is necessary. Defenders and administrators of systems using Apache Thrift Java bindings should assess exposure and upgrade to version 0.24.0 if necessary.

Vendor
Apache Software Foundation
Product
Apache Thrift
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-31
Original CVE updated
2026-10-31
Advisory published
2026-10-31
Advisory updated
2026-10-31

Who should care

Defenders and administrators of systems using Apache Thrift Java bindings should assess exposure and upgrade to version 0.24.0 if necessary.

Why it matters

CVE-2026-120135 is an Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. Defenders and administrators of systems using Apache Thrift Java bindings should assess exposure and upgrade to version 0.24.0 if necessary. The vulnerability may lead to potential denial of service due to uncontrolled recursion. Details on exploitation or impact are limited, and verification of affected systems is necessary.

  • Potential denial of service due to uncontrolled recursion
  • Need to verify and upgrade affected systems

Technical summary

The Uncontrolled Recursion vulnerability in Apache Thrift Java bindings affects versions before 0.24.0. The issue is fixed in version 0.24.0. The vulnerability may lead to potential denial of service due to uncontrolled recursion. Defenders and administrators of systems using Apache Thrift Java bindings should assess exposure and upgrade to version 0.24.0 if necessary. Details on exploitation or impact are limited.

Defensive priority

Upgrade to version 0.24.0

Recommended defensive actions

  • Upgrade to Apache Thrift version 0.24.0
  • Review and update affected systems
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide information on the vulnerability, but details on exploitation or impact are limited. The vulnerability affects Apache Thrift Java bindings in versions before 0.24.0. The issue is fixed in version 0.24.0. Limited information is available on potential exploitation attempts or specific impacts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-120135 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-120135

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-120135 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-120135

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.