[
https://issues.apache.org/jira/browse/THRIFT-6090?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6090.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Bound receive size and amortize buffer growth in Node.js transports
> -------------------------------------------------------------------
>
> Key: THRIFT-6090
> URL: https://issues.apache.org/jira/browse/THRIFT-6090
> Project: Thrift
> Issue Type: Bug
> Components: Node.js - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> TBufferedTransport and TFramedTransport's receiver functions in the Node.js
> library grew their receive buffer without an overall size cap and without
> amortized (geometric) growth, so a server accepting data from an
> unauthenticated peer had no way to bound per-connection memory use or avoid
> quadratic-time buffer growth on many small appends.
> Fixed by adding geometric buffer growth plus an optional maxLength parameter
> to both receivers, with server.js/web_server.js applying a default cap and
> surfacing an over-cap condition via the stream error path.
> *Affects:* Node.js TBufferedTransport and TFramedTransport, present in
> 0.23.0; fixed in 0.24.0
> *Fixed by:* commit 4ff326d9a
> *CWE-407 / CWE-770:* Inefficient Algorithmic Complexity / Allocation of
> Resources Without Limits or Throttling
> *CVSS 4.0:* approx. 8.7 High
> ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}}) -- note
> this is not an amplification attack (the peer must transmit the full
> payload); actual severity depends on deployment.
> *Reported by:* Song Jihoon
> *CVE:* CVE-2026-55968
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
