Intel

CVE-2026-86537

thrift: Uncaught Exception (CVE-2026-86537)

highEPSS 0.5%

Description

Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Source: OSV (Open Source Vulnerabilities)Microsoft Security Update Guidecvelistv5NVD (NIST)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnamithrift

Metrics

XIEM Effective CVSS
8.7
Source: cna-v4
EPSS percentile
44.5 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
89.32
Exploit maturity
no public PoC known
CVSS v4
8.7
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-10-09 10:53 UTC
CWE
CWE-248, CWE-835, CWE-191

Weakness classes (CWE)

  • CWE-248Base

    Uncaught Exception

    An exception is thrown from a function, but it is not caught.

    cwe.mitre.org →

  • CWE-835Base

    Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

    cwe.mitre.org →

  • CWE-191Base

    Integer Underflow (Wrap or Wraparound)

    The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-10-02 15:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-86537","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
  2. New CVE Received2026-10-02 12:17 UTC· security@apache.org
    • Description: Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
    • CVSS V4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    • CWE: CWE-191
    • CWE: CWE-248