[
https://issues.apache.org/jira/browse/THRIFT-6084?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6084.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Add byte-count limit to TCompactProtocol varint reader
> ------------------------------------------------------
>
> Key: THRIFT-6084
> URL: https://issues.apache.org/jira/browse/THRIFT-6084
> Project: Thrift
> Issue Type: Bug
> Components: Go - Library, Java - Library, PHP - Library, Python -
> Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> TCompactProtocol's varint reader had no upper bound on the number of
> continuation bytes it would consume, so a peer could send an unterminated
> varint (continuation bit always set) and force an unbounded read loop.
> Fixed by rejecting varints longer than 10 bytes in the reader, raising a
> protocol error instead of looping indefinitely. Applied to the Python, Go,
> PHP, and Java implementations; the same class of fix applies more broadly
> across the project's TCompactProtocol implementations.
> *Affects:* Python, Go, PHP, Java (TCompactProtocol)
> *Fixed by:* branch {{compact-varint-limit}}, PR #3410, merged 2026-04-23;
> fixed in 0.24.0
> *CWE-835:* Loop with Unreachable Exit Condition ("Infinite Loop")
> *CVSS 4.0:* 8.7 High
> ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
> *Reported by:* August829, via [email protected]
> *CVE:* CVE-2026-43871
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
