Resource Allocation Vulnerability in Apache Thrift by The Apache Software Foundation
CVE-2026-94644

8.2HIGH

Key Information:

Vendor

Apache
Status
Apache Thrift
Vendor
CVE Published:
2 October 2026

What is CVE-2026-94644?

A vulnerability has been identified in the Apache Thrift PHP bindings, where resources are allocated without proper limits or throttling. This flaw can lead to excessive resource consumption, potentially impacting the performance and stability of affected applications. It is critical for users to upgrade to version 0.25.0 or later to mitigate this issue and ensure the security and efficiency of their systems.

Affected Version(s)

Apache Thrift 0 < 0.25.0

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znz...
vendor-advisory
https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7js...
vendor-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sylwester Lachiewicz
.