Vulnerability details
CVE-2026-94635
Apache Software Foundation Apache Thrift
Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
CVSS 4.0
8.7High
Official description
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (apache) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Apache Software Foundation | Apache Thrift | v < 0.25.0 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 vendor-advisory
- https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3 vendor-advisory
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-02
- Last updated
- 2026-10-02
- State
- Published
- Assigner (CNA)
- apache
Exploit prediction (EPSS)
0.34%
Probability of exploitation in 30 days
27.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-770Allocation of resources without limits or throttling
- CWE-130Improper handling of length parameter inconsistency