CVE-2026-45112

Publication date 27 July 2026

Last updated 7 August 2026

Ubuntu priority

Cvss 3 Severity Score

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libthrift-java	26.04 LTS resolute	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	18.04 LTS bionic	Needs evaluation

Severity score breakdown

CVSS version:

Base score 6.9 · Medium

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Attack requirements	None
Privileges required	None
User interaction	None
Vulnerable system - Confidentiality impact	None
Vulnerable system - Integrity impact	None
Vulnerable system - Availability impact	Low
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	6.9 · Medium
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Base score 7.5 · High