CVE-2026-61373

{
  "etk_id": "ETK-2026-478",
  "cve_id": "CVE-2026-61373",
  "display_id": "CVE-2026-61373",
  "ghsa_id": "GHSA-3fh5-v6fh-cvj7",
  "euvd_id": "EUVD-2026-91410",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded resource allocation in Apache Thrift TSaslNonblockingServer",
  "summary": "Apache Thrift Java TSaslNonblockingServer versions before 0.25.0 are affected by unbounded resource allocation. An attacker may cause excessive resource consumption when able to interact with the affected server before authentication.",
  "mitigation": "Upgrade org.apache.thrift:libthrift to version 0.25.0 or later.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Thrift",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.25.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.25.0"
      ],
      "package_name": "org.apache.thrift:libthrift",
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0043,
  "epss_percentile": 0.3551,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.806802033333334,
  "t0_at": "2026-10-02T11:07:29.248000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T11:07:29.248000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T11:07:29.248000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61373"
    }
  }
}