CVE-2026-55971 is a critical (CVSS 9.8) heap based buffer overflow in the C++ bindings of Apache Thrift before version 0.24.0. The Apache advisory says to upgrade to 0.24.0, which fixes it. Rebuild any C++ service or tool that links the Thrift library.
What's affected
The Apache announcement says the issue affects Apache Thrift before 0.24.0, in the C++ bindings. Version 0.24.0 contains the fix. The record does not list a narrower range or a specific protocol or transport.
The CVSS vector is AV:N/AC:L/PR:N/UI:N with high impact on confidentiality, integrity and availability. That is the highest tier: reachable over the network, no account, no user action.
Thrift is a library, so the exposure depends on your build. A service is affected only if it compiles in or links the vulnerable C++ code. Generated code from the Thrift compiler is built against the library version you link, so check both.
How to check if you're exposed
Thrift often arrives as a transitive dependency of a C++ service, a database client or a vendor package. Look in three places.
- In source builds, check the version of the Thrift library in your package manager (for example conan, vcpkg or the system packages) and in any vendored copy of the sources.
- On a build host with the compiler installed, run thrift -version to see which compiler version generated your code.
- In container images, list the installed packages and look for libthrift.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade Thrift to 0.24.0 or later in every C++ project, and in base images and vendored copies.
- Rebuild and redeploy each service that links the library. Updating a package on the host is not enough for a statically linked binary.
- Regenerate Thrift code with a matching compiler if your process pins the compiler to the library version.
- Until you have redeployed, restrict network access to Thrift services to the clients that need them.
- Record which services use Thrift so the next advisory takes minutes to answer.
Why it matters
The weakness is CWE-122, a heap based buffer overflow. Code writes more data into a heap allocation than it can hold and overwrites whatever lives next to it. In a network library that parses input from callers, that can mean crashes or, in the worst case, code execution.
Apache has not published more detail in the sources I read, so I will not guess at the trigger. The record is not in CISA's Known Exploited Vulnerabilities catalog. The score alone justifies a prompt upgrade, since Thrift services are usually internal RPC endpoints that hold sensitive data and are trusted by their neighbors.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect Thrift in other languages?
The advisory names the C++ bindings only. Other language libraries are not listed in the record, but keep them current as a routine.
Sources
Last reviewed: 19 October 2026.
