CVE-2026-120135
NoneCVSS
—
EPSS
0.6%
Published
Oct 31, 2026
CISA due date
—
The record
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121092 Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-674
- CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-674
- CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via… CWE-674
- CVE-2026-121423 SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows… CWE-674
- CVE-2026-120689 HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in… CWE-674
- CVE-2026-101180 DoS vulnerability in the file parsing module. CWE-674
- CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-674
- CVE-2026-61847 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-674