CVE-2026-94657
published 2026-10-02CVE-2026-94657: Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are…
PriorityP344high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.34%
27.5th percentile
Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings
vendor_redhat·2026-10-02·CVSS 8.2
CVE-2026-94657 [HIGH] CWE-770 thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings
thrift: thrift: Denial of Service via improper resource allocation in JavaME bindings
A flaw was found in Apache Thrift. A remote attacker could exploit improper resource allocation controls in the JavaME bindings to cause a Denial of Service (DoS). By sending requests that trigger unbounded resource consumption, an attacker can exhaust system resources and make the service unavailable.
Package: thrift (Red Hat Ceph Storage 7) - Affected
Package: thrift (Red Hat Ceph Storage 8) - Affected
Package: thrift (Red Hat Ceph Storage 9) - Affected
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
GHSA
Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-94657 [HIGH] CWE-770 Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.
Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-10-02
Published