CVE-2026-120135

{
  "etk_id": "ETK-2026-3198",
  "cve_id": "CVE-2026-120135",
  "display_id": "CVE-2026-120135",
  "ghsa_id": "GHSA-663r-q6wf-5j93",
  "euvd_id": "EUVD-2026-114735",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uncontrolled recursion in Apache Thrift Java bindings",
  "summary": "Apache Thrift's Java libthrift artifact is affected in versions before 0.24.0. An attacker may cause unbounded recursive processing in an affected application. The advisory does not specify the input or deployment preconditions required to trigger the issue.",
  "mitigation": "Upgrade org.apache.thrift:libthrift to version 0.24.0 or later. Prioritize updates for applications that process untrusted data.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Thrift",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.24.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.24.0"
      ],
      "package_name": "org.apache.thrift:libthrift",
      "purl": null
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.99335605,
  "t0_at": "2026-10-31T20:33:00.088000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-31T20:33:00.088000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T20:33:00.088000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-120135"
    }
  }
}