VYPR
← All advisories
High severityNVD Advisory· Published Oct 28, 2019· Updated Aug 4, 2024

CVE-2019-0205

CVE-2019-0205

Description

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Thrift up to 0.12.0 is vulnerable to an infinite loop when processing crafted input, leading to denial of service.

Vulnerability

Apache Thrift versions up to and including 0.12.0 contain a denial-of-service vulnerability that can cause a server or client to enter an endless loop when processing specially crafted input data. The issue arises from improper handling of certain data patterns in the Thrift protocol, which was partially addressed in version 0.11.0 but not fully resolved, leaving some language bindings still affected [1].

Exploitation

An attacker can exploit this vulnerability by sending a malicious request containing specific crafted data to a Thrift endpoint. No authentication is required for remote exploitation, and the attack can be performed over the network. The vulnerability is particularly impactful in environments where Thrift services are exposed to untrusted clients [1].

Impact

Successful exploitation leads to a denial-of-service condition, as the affected Thrift server or client consumes excessive CPU resources indefinitely, potentially causing service unavailability. The vulnerability does not enable code execution or data exfiltration; its primary impact is on service availability [1].

Mitigation

The Apache Thrift project has addressed this vulnerability in version 0.13.0. Users are advised to upgrade to the latest release. Red Hat has also released updates for affected products, such as Red Hat JBoss Enterprise Application Platform, as part of their errata [2][3][4].

References
  1. NVD - CVE-2019-0205
  2. https://access.redhat.com/errata/RHSA-2020:0805
  3. https://access.redhat.com/errata/RHSA-2020:0804
  4. https://access.redhat.com/errata/RHSA-2020:0806

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.thrift:libthriftMaven
< 0.13.00.13.0

Affected products

136

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

79

News mentions

0

No linked articles in our index yet.