CVE-2026-94645
published 2026-10-02CVE-2026-94645: Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This…
PriorityP345high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.30%
22.8th percentile
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thrift: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
vendor_redhat·2026-10-02·CVSS 8.2
CVE-2026-94645 [HIGH] CWE-606 thrift: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
thrift: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in the Apache Thrift Node.js bindings. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted input specifying improper quantity values. Because the application fails to properly validate the requested quantity before allocating resources, processing these requests can lead to excessive resource consumption and service unavailability.
Package: thrift (Red Hat Har
GHSA
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-94645 [HIGH] CWE-770 Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-10-02
Published