CVE-2026-94654
published 2026-10-02CVE-2026-94654: Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users…
PriorityP343high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.33%
26.2th percentile
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-94654 [HIGH] CWE-835 Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: thrift: Denial of Service via infinite loop in Python bindings
vendor_redhat·2026-10-02·CVSS 8.2
CVE-2026-94654 [HIGH] CWE-835 thrift: thrift: Denial of Service via infinite loop in Python bindings
thrift: thrift: Denial of Service via infinite loop in Python bindings
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in Apache Thrift's Python bindings. A remote attacker could trigger an infinite loop during data processing, leading to a Denial of Service (DoS). By sending specially crafted input, an attacker can cause the application to hang and consume excessive resources, making the service unavailable to legitimate users.
Package: thrift (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
2026-10-02
Published