Read the docs
TI-2020-10925 Aliases CVE-2020-13949GHSA-g2fg-mr77-6vrm

Uncontrolled resource consumption in Apache Thrift

Priority MEDIUM 43CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 16 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Why it matters now

EPSS 0.06861 94th percentileScored 2026-11-07
Fix Partial org.apache.thrift:libthrift (Maven): 0.14.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 16 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache ThriftApache Thrift 0.9.3 to 0.13.0—No fix listedCNA
—org.apache.thrift:libthrift (Maven)0.9.3 to before 0.14.00.14.0Patch availableGHSA-g2fg-mr77-6vrm
  • Apache Thrift Vendor— Affected Apache Thrift 0.9.3 to 0.13.0 Fixed in — No fix listed CNA
  • org.apache.thrift:libthrift (Maven) Vendor— Affected 0.9.3 to before 0.14.0 Fixed in 0.14.0 Patch available GHSA-g2fg-mr77-6vrm

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:*before 4.0.0VulnerableApache
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*0.9.3 – 0.13.0VulnerableApache
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
  • cpe:2.3:a:apache:hive:*:*:*:*:*:*:*:* Versions before 4.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions 0.9.3 – 0.13.0 Vulnerable ·Apache
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-g2fg-mr77-6vrm org.apache.thrift:libthrift (Maven) Fixed in 0.14.0 Advisory →

Red Hat 3 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:2543 Released 2021-06-24 · Red Hat rating Moderate
    Red Hat OpenShift Jaeger 1.20.4 security update
    • Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat OpenShift Jaeger 1.20Fixed RHSA-2021:2543
Not affected: 4 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Decision Manager 7
  • Red Hat OpenShift Container Platform Assisted Installer 1
  • Red Hat OpenShift Jaeger 1.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13949
  2. 2026-10-03 Alias added: GHSA-g2fg-mr77-6vrm

References

Patch 2

Advisory 3

Other 210

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences