First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-120135

HighCVSS 8.2/10Last modified Nov 6, 2026

Description

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Metrics

CVSS 4.0 8.2/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache Thrift	< 0.24.0

References

Timeline

Published: Oct 31, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1201398.8Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system CVE-2026-120148.3Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sa CVE-2026-1201418.8Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system u CVE-2026-1201428.8Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running CVE-2026-1201438.8Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the d CVE-2026-1201448.8Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system CVE-2026-1201458.8Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system use CVE-2026-1201464.3Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It al CVE-2026-1201478.8Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running th CVE-2026-1201488.1Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the CVE-2026-1201498.8Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inse CVE-2026-120155.3Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to ob

CVE-2026-120135: High severity, CVSS 8.2 | Vulnix