Jens Geyer created THRIFT-6095:
----------------------------------
Summary: Enforce max_string_size on non-strict binary message name
Key: THRIFT-6095
URL: https://issues.apache.org/jira/browse/THRIFT-6095
Project: Thrift
Issue Type: Bug
Components: Rust - Library
Reporter: Jens Geyer
Fix For: 0.24.0
TBinaryProtocol::read_message_begin in the Rust library enforced the configured
max_string_size limit on the strict (modern) wire-format path but not on the
non-strict (legacy) path, which reads the message name length directly as a
big-endian i32. A peer using the legacy format could send a name-length field
of up to i32::MAX, triggering an allocation of roughly 2GiB regardless of a
configured max_string_size.
Fixed by adding the same max_string_size check to the non-strict path,
mirroring the strict path.
*Affects:* Rust (lib/rs), applications that explicitly configure
max_string_size; fixed in 0.24.0
*Fixed by:* PR #3609
*CWE-770:* Allocation of Resources Without Limits or Throttling
*CVSS 4.0:* 8.7 High
({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
*Reported by:* found and fixed by Javid Khan (PR #3609)
*CVE:* CVE-2026-58389
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
