CVE-2026-83632

DOCUMENTATION: A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) or memory corruption by sending specially crafted network requests to services utilizing the C++ HTTP transport layer. Due to improper input validation and resource handling, these requests trigger an integer overflow and excessive memory allocation, resulting in service disruption. 

            STATEMENT: This vulnerability is rated as Moderate impact for Red Hat products because triggering the flaw requires an application to specifically utilize the Thrift C++ HTTP transport implementation to process untrusted network input, and exploitation primarily leads to service termination or resource exhaustion rather than arbitrary code execution. In standard Red Hat deployments, components bundling Apache Thrift often rely on non-C++ language bindings or alternative transport mechanisms. Consequently, the blast radius is confined to a denial-of-service condition under specific, non-default transport configurations.

            MITIGATION: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.