CVE-2026-94654
HighCVSS 8.2Summary
Infinite loop vulnerability in Apache Thrift Python bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
Risk Assessment
Infinite loop can cause process hang or resource exhaustion, potentially leading to denial of service.
Recommendation
Upgrade Apache Thrift to version 0.25.0 or later.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-96289High
Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.
- CVE-2026-96287High
Apache Thrift Perl bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive CPU or memory consumption.
- CVE-2026-96286High
Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.
- CVE-2026-96277High
Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.
- CVE-2026-94658High
Apache Thrift Lua bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive resource consumption.
- CVE-2026-94657High
Apache Thrift JavaME bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94656High
Apache Thrift Ruby bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94655High
Apache Thrift Lua bindings before version 0.25.0 have allocation of resources without limits or throttling and inefficient algorithmic complexity vulnerabilities, which can lead to resource exhaustion and slowdown.
- CVE-2026-85476High
Infinite loop vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
- CVE-2026-83745High
Vulnerability in Apache Thrift nodejs and D language bindings due to improper handling of length parameter, leading to excessive memory allocation. A small frame can cause allocation of up to 2 GiB. Affects versions before 0.25.0.
Original NVD description (English source)
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS