CVE-2020-13949

HIGH

Apache Thrift 0.9.3-0.13.0 - Uncontrolled Resource Consumption via Short RPC Messages

Title source: llm
STIX 2.1

Description

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

References (108)

Core 108
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202107-32
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com//security-alerts/cpujul2021.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html

Scores

CVSS v3 7.5
EPSS 0.0084
EPSS Percentile 75.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (5)
apache/hive < 4.0.0
apache/thrift 0.9.3 - 0.13.0
oracle/communications_cloud_native_core_network_slice_selection_function 1.2.1
oracle/communications_cloud_native_core_policy 1.14.0
org.apache.thrift/libthrift 0.9.3 - 0.14.0Maven
Published Feb 12, 2021
Tracked Since Feb 18, 2026