Jens Geyer created THRIFT-6084:
----------------------------------
Summary: Add byte-count limit to TCompactProtocol varint reader
Key: THRIFT-6084
URL: https://issues.apache.org/jira/browse/THRIFT-6084
Project: Thrift
Issue Type: Bug
Components: Java - Library, Python - Library, Go - Library, PHP -
Library
Reporter: Jens Geyer
Fix For: 0.24.0
TCompactProtocol's varint reader had no upper bound on the number of
continuation bytes it would consume, so a peer could send an unterminated
varint (continuation bit always set) and force an unbounded read loop.
Fixed by rejecting varints longer than 10 bytes in the reader, raising a
protocol error instead of looping indefinitely. Applied to the Python, Go, PHP,
and Java implementations; the same class of fix applies more broadly across the
project's TCompactProtocol implementations.
*Affects:* Python, Go, PHP, Java (TCompactProtocol)
*Fixed by:* branch {{compact-varint-limit}}, PR #3410, merged 2026-04-23; fixed
in 0.24.0
*CWE-835:* Loop with Unreachable Exit Condition ("Infinite Loop")
*CVSS 4.0:* 8.7 High
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
*Reported by:* August829, via [email protected]
*CVE:* CVE-2026-43871
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
