new file mode 100644
@@ -0,0 +1,93 @@
+From 44c46c076527db5a4b97c55f09a6f73ab9443cee Mon Sep 17 00:00:00 2001
+From: Javid Khan <dxbjavid@gmail.com>
+Date: Mon, 29 Jun 2026 19:51:49 +0530
+Subject: [PATCH] enforce max_string_size on non-strict binary message name
+
+
+CVE: CVE-2026-58389
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/rs/src/protocol/binary.rs | 61 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 61 insertions(+)
+
+diff --git a/lib/rs/src/protocol/binary.rs b/lib/rs/src/protocol/binary.rs
+index 596285fb9..38f528571 100644
+--- a/lib/rs/src/protocol/binary.rs
++++ b/lib/rs/src/protocol/binary.rs
+@@ -137,6 +137,17 @@ where
+ // is the message name. strings (byte arrays) are length-prefixed,
+ // so we've just read the length in the first 4 bytes
+ let name_size = BigEndian::read_i32(&first_bytes) as usize;
++ if let Some(max_size) = self.config.max_string_size() {
++ if name_size > max_size {
++ return Err(crate::Error::Protocol(ProtocolError::new(
++ ProtocolErrorKind::SizeLimit,
++ format!(
++ "Message name size {} exceeds maximum allowed size of {}",
++ name_size, max_size
++ ),
++ )));
++ }
++ }
+ let mut name_buf: Vec<u8> = vec![0; name_size];
+ self.transport.read_exact(&mut name_buf)?;
+ let name = String::from_utf8(name_buf)?;
+@@ -1227,6 +1238,56 @@ mod tests {
+ }
+ }
+
++ #[test]
++ fn must_enforce_string_size_limit_on_non_strict_message_name() {
++ let mem = TBufferChannel::with_capacity(100, 100);
++ let (r_mem, mut w_mem) = mem.split().unwrap();
++
++ let config = TConfiguration::builder()
++ .max_string_size(Some(1000))
++ .build()
++ .unwrap();
++ // non-strict: the first 4 bytes are the (positive) message-name length
++ let mut i_prot = TBinaryInputProtocol::with_config(r_mem, false, config);
++
++ w_mem.set_readable_bytes(&[0x00, 0x00, 0x07, 0xD0]);
++
++ let result = i_prot.read_message_begin();
++ assert!(result.is_err());
++ match result {
++ Err(crate::Error::Protocol(e)) => {
++ assert_eq!(e.kind, ProtocolErrorKind::SizeLimit);
++ assert!(e
++ .message
++ .contains("Message name size 2000 exceeds maximum allowed size of 1000"));
++ }
++ _ => panic!("Expected protocol error with SizeLimit"),
++ }
++ }
++
++ #[test]
++ fn must_allow_non_strict_message_name_at_limit() {
++ let mem = TBufferChannel::with_capacity(100, 100);
++ let (r_mem, mut w_mem) = mem.split().unwrap();
++
++ let config = TConfiguration::builder()
++ .max_string_size(Some(5))
++ .build()
++ .unwrap();
++ // non-strict: the first 4 bytes are the (positive) message-name length
++ let mut i_prot = TBinaryInputProtocol::with_config(r_mem, false, config);
++
++ // name length 5 (== limit), name "hello", message type Call, sequence 0
++ w_mem.set_readable_bytes(&[
++ 0x00, 0x00, 0x00, 0x05, b'h', b'e', b'l', b'l', b'o', 0x01, 0x00, 0x00, 0x00, 0x00,
++ ]);
++
++ let ident = i_prot.read_message_begin().unwrap();
++ assert_eq!(ident.name, "hello");
++ assert_eq!(ident.message_type, TMessageType::Call);
++ assert_eq!(ident.sequence_number, 0);
++ }
++
+ #[test]
+ fn must_allow_strings_within_limit() {
+ let mem = TBufferChannel::with_capacity(100, 100);
@@ -16,6 +16,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
file://CVE-2026-55971.patch \
file://CVE-2026-58023.patch \
file://CVE-2026-48144.patch \
+ file://CVE-2026-58389.patch \
"
SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"