CVE-2026-83663

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a loop, exhausting the execution stack. This stack exhaustion causes an unrecoverable fatal error that terminates the entire process.

This flaw has an Important impact because a remote attacker can send crafted requests to an affected Go Apache Thrift service and cause excessive recursion in transport handling, resulting in denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.