CVE-2026-43871
Fixed in a distro release EPSS 1%CVSS 8.7
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Products: Apache Software Foundation Apache Thrift
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/apache/thrift | 0.24.0 |
| Maven | org.apache.thrift:libthrift | 0.24.0 |
| Packagist | apache/thrift | 0.24.0 |
| PyPI | thrift | 0.24.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | agentbeat | 9.2.7-r27 |
| Chainguard | agentbeat-fips | 9.2.7-r25 |
| Chainguard | amazon-cloudwatch-agent | 1.300073.0-r1 |
| Chainguard | amazon-cloudwatch-agent | 1.300072.0-r6 |
| Chainguard | amazon-cloudwatch-agent-fips | 1.300072.0-r5 |
| Chainguard | apm-server-8.19 | 8.19.21-r2 |
| Chainguard | apm-server-fips-8.19 | 8.19.21-r1 |
| Chainguard | automq | 1.7.4-r1 |
| Chainguard | automq | no fix |
| Chainguard | automq-fips | 1.7.4-r1 |
| Chainguard | automq-fips | no fix |
| Chainguard | bento | 1.21.1-r3 |
| Chainguard | bento-fips | 1.21.1-r6 |
| Chainguard | cadence | 1.4.1-r11 |
| Chainguard | cadence-cassandra-tool | 1.4.1-r11 |
| Chainguard | cadence-fips | 1.4.1-r11 |
| Chainguard | cadence-fips-cassandra-tool | 1.4.1-r11 |
| Chainguard | cadence-fips-server | 1.4.1-r11 |
| Chainguard | cadence-fips-sql-tool | 1.4.1-r11 |
| Chainguard | cadence-server | 1.4.1-r11 |
| Chainguard | cadence-sql-tool | 1.4.1-r11 |
| Chainguard | commercial-expanso-edge | no fix |
| Chainguard | commercial-grafana-11.6 | no fix |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | no fix |
| Chainguard | commercial-grafana-12.3 | no fix |
| Chainguard | commercial-grafana-12.4 | 12.4.12-r0 |
| Chainguard | commercial-grafana-13.0 | 13.0.10-r0 |
| Chainguard | commercial-grafana-13.1 | 13.1.7-r0 |
| Chainguard | commercial-grafana-13.2 | 13.2.3-r0 |
| Chainguard | dapr-daprd-1.15 | 1.15.14-r16 |
| Chainguard | dapr-daprd-1.15 | 1.15.14-r15 |
| Chainguard | dapr-daprd-fips-1.15 | 1.15.14-r17 |
| Chainguard | dapr-daprd-fips-1.15 | no fix |
| Chainguard | datadog-agent-7.76-full | no fix |
| Chainguard | datadog-agent-7.77-full | no fix |
| Chainguard | datadog-agent-7.78-full | no fix |
| Chainguard | datadog-agent-7.79-full | no fix |
| Chainguard | datadog-agent-7.80-core-integrations | 7.80.4-r16 |
| Chainguard | datadog-agent-7.80-full | 7.80.4-r14 |
| Chainguard | datadog-agent-7.80-oci-compat | no fix |
| Chainguard | datadog-agent-7.80-s6-overlay | 7.80.4-r16 |
| Chainguard | datadog-agent-7.81-full | no fix |
| Chainguard | datadog-agent-7.82-full | no fix |
| Chainguard | datadog-agent-fips-7.76-full | no fix |
| Chainguard | datadog-agent-fips-7.77-full | 7.77.3-r32 |
| Chainguard | datadog-agent-fips-7.78-full | no fix |
| Chainguard | datadog-agent-fips-7.79-full | no fix |
| Chainguard | datadog-agent-fips-7.80-full | no fix |
| Chainguard | datadog-agent-fips-7.81-full | no fix |
| Chainguard | datadog-agent-fips-7.82-full | no fix |
| Chainguard | druid | no fix |
| Chainguard | elastic-agent-9.2 | 9.2.8-r22 |
| Chainguard | elastic-agent-fips-9.2 | 9.2.8-r17 |
| Chainguard | elastic-otel-collector-9.3 | 9.3.8-r6 |
| Chainguard | elastic-otel-collector-fips-9.3 | no fix |
| Chainguard | filebeat-9.2 | 9.2.8-r29 |
| Chainguard | filebeat-9.3 | 9.3.8-r12 |
| Chainguard | filebeat-fips-9.2 | no fix |
| Chainguard | filebeat-fips-9.3 | 9.3.8-r7 |
| Chainguard | grafana-11.6 | no fix |
| Chainguard | grafana-12.1 | 12.1.10.01-r22 |
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-12.3 | 12.3.11-r5 |
| Chainguard | grafana-12.4 | 12.4.10-r1 |
| Chainguard | grafana-13.0 | 13.0.8-r1 |
| Chainguard | grafana-13.1 | 13.1.4-r5 |
| Chainguard | grafana-13.2 | 13.2.1-r3 |
| Chainguard | grafana-fips-11.6 | 11.6.16-r14 |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r12 |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | grafana-fips-12.3 | no fix |
| Chainguard | grafana-fips-12.4 | 12.4.10-r3 |
| Chainguard | grafana-fips-13.0 | 13.0.8-r1 |
| Chainguard | grafana-fips-13.1 | 13.1.5-r2 |
| Chainguard | grafana-fips-13.2 | 13.2.1-r3 |
| Chainguard | grafana-geomys-fips-13.1 | 13.1.5-r1 |
| Chainguard | jaeger-1-all-in-one | no fix |
| Chainguard | jaeger-1-collector | no fix |
| Chainguard | jaeger-1-fips-all-in-one | no fix |
| Chainguard | jaeger-1-fips-collector | no fix |
| Chainguard | jaeger-1-fips-ingester | no fix |
| Chainguard | jaeger-1-fips-query | no fix |
| Chainguard | jaeger-1-ingester | no fix |
| Chainguard | jaeger-1-query | no fix |
| Chainguard | jaeger-2 | 2.21.0-r0 |
| Chainguard | jaeger-2-all-in-one-compat | no fix |
| Chainguard | jaeger-2-fips-jaeger | 2.20.0-r8 |
| Chainguard | jaeger-2-fips-query | no fix |
| Chainguard | jaeger-2-jaeger | 2.20.0-r9 |
| Chainguard | jaeger-2-jaeger-compat | no fix |
| Chainguard | jaeger-2-remote-storage | 2.20.0-r9 |
| Chainguard | jitsucom-bulker-bulker | 2.15.0-r2 |
| Chainguard | jitsucom-bulker-sidecar | 2.15.0-r2 |
| Chainguard | jitsucom-bulker-sidecar-compat | 2.15.0-r4 |
| Chainguard | kserve-modelmesh | no fix |
| Chainguard | milvus-2.5 | 2.5.27-r28 |
| Chainguard | milvus-2.6 | 2.6.23-r3 |
| Chainguard | milvus-3.0 | 3.0.0-r8 |
| Chainguard | minio | 0.20260717.120751-r12 |
| Chainguard | minio-fips | 0.20260717.120751-r8 |
| Chainguard | nri-cassandra | 2.23.1-r1 |
| Chainguard | nri-cassandra-fips | 2.23.1-r3 |
| Chainguard | nri-cassandra-jdk11 | 2.23.1-r1 |
| Chainguard | nri-jmx | 3.17.0-r1 |
| Chainguard | nri-jmx-fips | 3.17.0-r0 |
| Chainguard | nri-jmx-jdk11 | 3.17.0-r1 |
| Chainguard | nri-kafka | 3.24.0-r0 |
| Chainguard | nri-kafka-fips | 3.24.0-r2 |
| Chainguard | nri-kafka-jdk11 | 3.24.0-r0 |
| Chainguard | nuxeo-2023 | 2023.45-r13 |
| Chainguard | plutono | 7.5.50-r10 |
| Chainguard | plutono-fips | 7.5.50-r9 |
| Chainguard | ranger | no fix |
| Chainguard | seaweedfs | 4.45-r3 |
| Chainguard | seaweedfs-fips | 4.45-r3 |
| Chainguard | seaweedfs-rocksdb | 4.45-r2 |
| Chainguard | seaweedfs-rocksdb-fips | 4.45-r4 |
| Chainguard | solr-9-full | 9.10.1-r14 |
| Chainguard | solr-fips-9-full | 9.10.1-r2 |
| Chainguard | spark-3.5-scala-2.12 | no fix |
| Chainguard | spark-3.5-scala-2.13 | no fix |
| Chainguard | spark-4.0-scala-2.13 | no fix |
| Chainguard | spark-4.1-scala-2.13 | no fix |
| Chainguard | spark-4.2-scala-2.13 | no fix |
| Chainguard | spark-fips-3.5-scala-2.12 | no fix |
| Chainguard | spark-fips-3.5-scala-2.13 | no fix |
| Chainguard | spark-fips-4.1-scala-2.13 | no fix |
| Chainguard | spark-fips-4.2-scala-2.13 | no fix |
| Chainguard | telegraf-1.36 | 1.36.4-r17 |
| Chainguard | telegraf-1.37 | no fix |
| Chainguard | tempo-2.10 | 2.10.8-r3 |
| Chainguard | tempo-2.10-query | 2.10.8-r3 |
| Chainguard | tempo-2.8 | 2.8.4-r17 |
| Chainguard | tempo-2.8-cli | 2.8.4-r17 |
| Chainguard | tempo-2.8-query | 2.8.4-r17 |
| Chainguard | tempo-2.8-vulture | 2.8.4-r17 |
| Chainguard | tempo-2.9 | 2.9.5-r4 |
| Chainguard | tempo-2.9-cli | 2.9.5-r4 |
| Chainguard | tempo-2.9-query | 2.9.5-r4 |
| Chainguard | tempo-2.9-vulture | 2.9.5-r4 |
| Chainguard | tempo-3.0 | 3.0.3-r6 |
| Chainguard | tempo-3.0 | 3.0.3-r4 |
| Chainguard | tempo-3.0-cli | 3.0.3-r4 |
| Chainguard | tempo-3.0-query | 3.0.3-r4 |
| Chainguard | tempo-3.0-vulture | 3.0.3-r6 |
| Chainguard | tempo-3.0-vulture | 3.0.3-r4 |
| Chainguard | tempo-fips-2.10 | 2.10.8-r2 |
| Chainguard | tempo-fips-2.10-cli | 2.10.8-r2 |
| Chainguard | tempo-fips-2.10-query | 2.10.8-r2 |
| Chainguard | tempo-fips-2.10-vulture | 2.10.8-r2 |
| Chainguard | tempo-fips-2.8 | 2.8.4-r10 |
| Chainguard | tempo-fips-2.8-cli | 2.8.4-r10 |
| Chainguard | tempo-fips-2.8-query | 2.8.4-r10 |
| Chainguard | tempo-fips-2.8-vulture | 2.8.4-r10 |
| Chainguard | tempo-fips-2.9 | 2.9.5-r3 |
| Chainguard | tempo-fips-2.9-cli | 2.9.5-r3 |
| Chainguard | tempo-fips-2.9-query | 2.9.5-r3 |
| Chainguard | tempo-fips-2.9-vulture | 2.9.5-r3 |
| Chainguard | tempo-fips-3.0 | 3.0.3-r2 |
| Chainguard | tempo-fips-3.0-cli | 3.0.3-r2 |
| Chainguard | tempo-fips-3.0-query | 3.0.3-r2 |
| Chainguard | tempo-fips-3.0-vulture | 3.0.3-r2 |
| Chainguard | temporal | 1.8.3-r1 |
| Chainguard | temporal-fips | 1.8.3-r1 |
| Chainguard | temporal-server-1.29 | 1.29.7-r8 |
| Chainguard | temporal-server-1.30 | 1.30.6-r9 |
| Chainguard | temporal-server-1.31 | 1.31.2-r8 |
| Chainguard | temporal-server-fips-1.29 | 1.29.7-r6 |
| Chainguard | temporal-server-fips-1.30 | 1.30.6-r7 |
| Chainguard | temporal-server-fips-1.31 | 1.31.2-r7 |
| Chainguard | vault-1.21 | 1.21.4-r16 |
| Chainguard | vault-2.0 | 2.0.4-r3 |
| Chainguard | vault-2.1 | 2.1.0-r2 |
| Chainguard | vault-fips-1.21 | no fix |
| Chainguard | vault-fips-2.0 | 2.0.4-r2 |
| Chainguard | vault-fips-2.1 | 2.1.0-r2 |
| Chainguard | wavefront-proxy | 13.9-r27 |
| Chainguard | zipkin | 3.6.1-r24 |
| Debian 12 | thrift | no fix |
| Debian 13 | thrift | no fix |
| Debian 14 | thrift | no fix |
| Red Hat hummingbird 1 | perl-thrift | 0:0.24.0-0.1.hum1 |
| Red Hat hummingbird 1 | python3-thrift | 0:0.24.0-0.1.hum1 |
| Red Hat hummingbird 1 | thrift | 0:0.24.0-0.1.hum1 |
| Red Hat hummingbird 1 | thrift-devel | 0:0.24.0-0.1.hum1 |
| Red Hat hummingbird 1 | thrift-glib | 0:0.24.0-0.1.hum1 |
| Red Hat hummingbird 1 | thrift-qt | 0:0.24.0-0.1.hum1 |
| Ubuntu 16.04 LTS | libthrift-java | no fix |
| Ubuntu 18.04 LTS | libthrift-java | no fix |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | libthrift-java | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | libthrift-java | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 26.04 LTS | libthrift-java | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | libthrift-java | no fix |
| Ubuntu 26.10 | thrift | no fix |
| Wolfi | amazon-cloudwatch-agent | 1.300072.0-r6 |
| Wolfi | amazon-cloudwatch-agent | 1.300073.0-r1 |
| Wolfi | bento | 1.21.1-r3 |
| Wolfi | datadog-agent-7.77-full | no fix |
| Wolfi | datadog-agent-7.78-full | no fix |
| Wolfi | datadog-agent-7.79-full | no fix |
| Wolfi | datadog-agent-7.80-core-integrations | 7.80.4-r16 |
| Wolfi | datadog-agent-7.80-full | 7.80.4-r14 |
| Wolfi | datadog-agent-7.80-oci-compat | no fix |
| Wolfi | datadog-agent-7.80-s6-overlay | 7.80.4-r16 |
| Wolfi | datadog-agent-7.81-full | no fix |
| Wolfi | druid | no fix |
| Wolfi | grafana-12.3 | 12.3.11-r5 |
| Wolfi | grafana-12.4 | 12.4.10-r1 |
| Wolfi | grafana-13.0 | 13.0.8-r1 |
| Wolfi | jaeger-2 | 2.21.0-r0 |
| Wolfi | jaeger-2-all-in-one-compat | no fix |
| Wolfi | jaeger-2-jaeger | 2.20.0-r9 |
| Wolfi | jaeger-2-jaeger-compat | no fix |
| Wolfi | jaeger-2-remote-storage | 2.20.0-r9 |
| Wolfi | jitsucom-bulker-bulker | 2.15.0-r2 |
| Wolfi | jitsucom-bulker-sidecar | 2.15.0-r2 |
| Wolfi | jitsucom-bulker-sidecar-compat | 2.15.0-r4 |
| Wolfi | kserve-modelmesh | no fix |
| Wolfi | minio | 0.20260717.120751-r12 |
| Wolfi | nri-cassandra | 2.23.1-r1 |
| Wolfi | nri-cassandra-jdk11 | 2.23.1-r1 |
| Wolfi | nri-jmx | 3.17.0-r1 |
| Wolfi | nri-jmx-jdk11 | 3.17.0-r1 |
| Wolfi | nri-kafka | 3.24.0-r0 |
| Wolfi | nri-kafka-jdk11 | 3.24.0-r0 |
| Wolfi | seaweedfs | 4.45-r3 |
| Wolfi | spark-4.0-scala-2.13 | no fix |
| Wolfi | spark-4.1-scala-2.13 | no fix |
| Wolfi | telegraf-1.36 | 1.36.4-r17 |
| Wolfi | telegraf-1.37 | no fix |
| Wolfi | tempo-2.10 | 2.10.8-r3 |
| Wolfi | tempo-2.10-query | 2.10.8-r3 |
| Wolfi | tempo-3.0 | 3.0.3-r4 |
| Wolfi | tempo-3.0 | 3.0.3-r6 |
| Wolfi | tempo-3.0-cli | 3.0.3-r4 |
| Wolfi | tempo-3.0-query | 3.0.3-r4 |
| Wolfi | tempo-3.0-vulture | 3.0.3-r6 |
| Wolfi | tempo-3.0-vulture | 3.0.3-r4 |
| Wolfi | temporal | 1.8.3-r1 |
| Wolfi | wavefront-proxy | 13.9-r27 |
| Wolfi | zipkin | 3.6.1-r24 |
| openSUSE Tumbleweed | thrift | 0.24.0-1.1 |