High severity · published Oct 29, 2019
CVE-2019-0205
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data
7.5
CVSS
9.2%
EPSS
No
On KEV
Description
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.2% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Communications Cloud Native Core Network Slice Selection Function · Oracle
1.2.1 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
7.2.0 · source: NVD
TH
Thrift · Apache
through 0.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0205
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0205
Mailing List
http://mail-archives.apache.org/mod_mbox/thrift-dev/201910.mbox/%3CVI1PR0101MB2142E0EA19F582429C3AEBCBB1920%40VI1PR0101MB2142.eurprd01.prod.exchangelabs.com%3E
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0804
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0805
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0806
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0811
lists.apache.org
https://lists.apache.org/thread.html/003ac686189e6ce7b99267784d04bf60059a8c323eeda5a79a0309b8%40%3Ccommits.cassandra.apache.org%3E
More from Thrift
9.8
CVE-2026-55971
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
9.1
CVE-2026-58662
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
9.1
CVE-2026-58023
Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
9.1
CVE-2026-48144
Apache Thrift: c_glib TLS Client Missing Hostname Verification
8.8
CVE-2016-5397
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool