CVE-2026-83745
CVE-2026-83745 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-130.
Key facts
- Severity: High (CVSS 4.0 base score 8.7)
- EPSS exploit prediction: 0% (35th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-130
- Published:
- Last modified:
Description
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Frequently asked questions
- What is CVE-2026-83745?
- Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- How severe is CVE-2026-83745?
- CVE-2026-83745 has a CVSS 4.0 base score of 8.7, rated high severity.
- Is CVE-2026-83745 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-83745?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-83745 published?
- CVE-2026-83745 was published on 2026-10-02.
References
- https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
- https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc
Other CWE-130 vulnerabilities
- CVE-2022-2714 — Critical (CVSS 9.8): Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
- CVE-2026-18397 — Critical (CVSS 9.4): This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a…
- CVE-2026-9054 — Critical (CVSS 9.2): An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel…
- CVE-2026-5706 — High (CVSS 8.9): In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to…
- CVE-2026-58096 — High (CVSS 8.8): LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required…
- CVE-2022-1543 — High (CVSS 8.8): Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large…