Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
kata-containers-cc may crash from crafted Thrift messages
published 1 month ago
Summary
The kata-containers-cc package uses the Apache Thrift library, which can be forced into an endless loop that exhausts memory and stops the whole service. An attacker who sends specially crafted data can make the process terminate unexpectedly. Updating the Thrift component to version 0.25.0 (or a newer kata-containers-cc package that includes this update) eliminates the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kata-containers-cc | <= 3.15.0.aks0-21 |
Original advisory text
CVE-2026-83663 affecting package kata-containers-cc 3.15.0.aks0-21
Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
References
Timeline
Published2 Oct 2026
Updated7 Oct 2026
First seen7 Oct 2026
Sources
AZL-106518 · OSV
Track software like this
Free during beta