Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-83663

CVE-2026-83663: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh8.7

    High [CVE-2026-83663] Uncontrolled Recursion vulnerability in Apache Thrift go bindings

    CVE-2026-83663Source published Source updated

    Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

    Affected products in this advisory
    • Apache Thrift
    Source-reported affected versions
    • Apache Thrift before 0.25.0
    Source-reported fixed versions
    • 0.25.0
    Mitigation guidance
    • The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.
    • Users are recommended to upgrade to version 0.25.0, which fixes the issue.
    Workarounds
    • A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-83663] Denial of Service via unbounded recursion in Go transports

    CVE-2026-83663Source published Source updated

    Denial of Service via unbounded recursion in Go transports. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Cryostat 4; Logging Subsystem for Red Hat OpenShift; Multicluster Global Hub; and 16 more.

    Related products — impact not confirmed
    • Ansible Automation Orchestrator 2026
    • Cryostat 4
    • Logging Subsystem for Red Hat OpenShift
    • Multicluster Global Hub

    16 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features