[
https://issues.apache.org/jira/browse/THRIFT-6095?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6095.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Enforce max_string_size on non-strict binary message name
> ---------------------------------------------------------
>
> Key: THRIFT-6095
> URL: https://issues.apache.org/jira/browse/THRIFT-6095
> Project: Thrift
> Issue Type: Bug
> Components: Rust - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> TBinaryProtocol::read_message_begin in the Rust library enforced the
> configured max_string_size limit on the strict (modern) wire-format path but
> not on the non-strict (legacy) path, which reads the message name length
> directly as a big-endian i32. A peer using the legacy format could send a
> name-length field of up to i32::MAX, triggering an allocation of roughly 2GiB
> regardless of a configured max_string_size.
> Fixed by adding the same max_string_size check to the non-strict path,
> mirroring the strict path.
> *Affects:* Rust (lib/rs), applications that explicitly configure
> max_string_size; fixed in 0.24.0
> *Fixed by:* PR #3609
> *CWE-770:* Allocation of Resources Without Limits or Throttling
> *CVSS 4.0:* 8.7 High
> ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
> *Reported by:* found and fixed by Javid Khan (PR #3609)
> *CVE:* CVE-2026-58389
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
