CVE-2026-94635
published 2026-10-02CVE-2026-94635: Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This…
PriorityP349high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.34%
27.5th percentile
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-94635 [HIGH] CWE-130 Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings
vendor_redhat·2026-10-02·CVSS 8.7
CVE-2026-94635 [HIGH] CWE-130 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings
thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings
A flaw was found in the Apache Thrift Lua bindings. A remote attacker could exploit this vulnerability by sending requests containing inconsistent length parameters, triggering excessive resource allocation without proper limits. This issue can exhaust available system memory or processing capacity, resulting in a Denial of Service (DoS).
Package: thrift (Red Hat Ceph Storage 7) - Affected
Package: thrift (Red Hat Ceph Storage 8) - Affected
Package: thrift (Red Hat Ceph Storage 9) - Affected
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings [epel-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-94635 [HIGH] CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings [epel-all]
CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings [fedora-all]
bugzilla·2026-10-22·CVSS 8.7
CVE-2026-94635 [HIGH] CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings [fedora-all]
CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings
bugzilla·2026-10-02·CVSS 8.7
CVE-2026-94635 [HIGH] CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings
CVE-2026-94635 thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published