CVE-2026-94655
published 2026-10-02CVE-2026-94655: Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache…
PriorityP344high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.34%
27.5th percentile
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-94655 [HIGH] CWE-407 Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
vendor_redhat·2026-10-02·CVSS 8.2
CVE-2026-94655 [HIGH] CWE-770 thrift: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
thrift: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted input to an application that uses the Lua bindings. Due to a lack of proper resource allocation limits and inefficient processing, handling these requests consumes excessive system resources and causes the service to become unresponsive.
Package: thrift (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
2026-10-02
Published