CVE-2026-83663

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

• CWE-674

• https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
• https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-83657Weak authentication in Windows Modern Device Management (MDM…5.5
• CVE-2026-83658Improper access control in Windows Error Reporting allows an…5.5
• CVE-2026-83659Improper link resolution before file access ('link following…7.8
• CVE-2026-83660Adobe Campaign Classic (ACC) is affected by a Server-Side Re…10
• CVE-2026-83661Photoshop Desktop is affected by an Integer Overflow or Wrap…7.8
• CVE-2026-83662Adobe Experience Manager is affected by a reflected Cross-Si…9.3
• CVE-2026-83664Access of resource using incompatible type ('type confusion'…5.5
• CVE-2026-83665Null pointer dereference in Windows DHCP Server allows an un…7.5
• CVE-2026-83666Concurrent execution using shared resource with improper syn…7
• CVE-2026-83667Out-of-bounds read in Active Directory Domain Services allow…6.5
• CVE-2026-83668Out-of-bounds read in Windows WLAN Service allows an authori…5.5
• CVE-2026-83669Use of uninitialized resource in Windows Error Reporting all…7.8