CVE-2026-93926
published 2026-10-02CVE-2026-93926: Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This…
PriorityP348high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.28%
20.0th percentile
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thrift: thrift: Denial of Service via memory leak in THeaderTransport
vendor_redhat·2026-10-02·CVSS 8.7
CVE-2026-93926 [HIGH] CWE-772 thrift: thrift: Denial of Service via memory leak in THeaderTransport
thrift: thrift: Denial of Service via memory leak in THeaderTransport
A flaw was found in Apache Thrift's THeaderTransport component. Due to a failure to release allocated memory and system resources after their operational lifetime, a remote attacker can exploit this vulnerability by sending network traffic that repeatedly consumes resources. This issue can cause system memory exhaustion, leading to a Denial of Service (DoS).
Package: thrift (Red Hat Ceph Storage 7) - Affected
Package: thrift (Red Hat Ceph Storage 8) - Affected
Package: thrift (Red Hat Ceph Storage 9) - Affected
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
GHSA
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
ghsa_unreviewed·2026-10-02
CVE-2026-93926 [HIGH] CWE-401 Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport [epel-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-93926 [HIGH] CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport [epel-all]
CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport [fedora-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-93926 [HIGH] CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport [fedora-all]
CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport
bugzilla·2026-10-02·CVSS 8.7
CVE-2026-93926 [HIGH] CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport
CVE-2026-93926 thrift: thrift: Denial of Service via memory leak in THeaderTransport
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published