Read the docs
TI-2015-02882 Aliases CVE-2015-3254GHSA-4rvx-g54x-9p63

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users…

Priority LOW 37CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.

Why it matters now

EPSS 0.05335 92nd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*up to 0.9.2VulnerableApache
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions up to 0.9.2 Vulnerable ·Apache

Remediation

Red Hat 2 advisories

  • RHSA-2017:3115 Released 2017-11-02 · Red Hat rating Moderate
    Red Hat JBoss Fuse/A-MQ 6.3 R5 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3
  • RHSA-2017:2477 Released 2017-08-15 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.3 Update 7 security update
    • Red Hat JBoss Data Virtualization 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.3Fixed RHSA-2017:3115
Red Hat JBoss Data Virtualization 6.3Fixed RHSA-2017:2477
Red Hat JBoss Fuse 6.3Fixed RHSA-2017:3115
Not affected: 1 product
  • Red Hat OpenShift Enterprise 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-3254
  2. 2026-10-03 Alias added: GHSA-4rvx-g54x-9p63

References

Patch 1

Advisory 3

Other 1

  • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
  • TI-2016-04675 Command injection in Apache Thrift CVSS 3.0HIGH 8.8
  • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
  • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
  • TI-2026-40371 Integer overflow in Apache Thrift CVSS 4.0HIGH 8.7
  • TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences