CVE-2026-94655
HighCVSS 8.2Summary
Apache Thrift Lua bindings before version 0.25.0 have allocation of resources without limits or throttling and inefficient algorithmic complexity vulnerabilities, which can lead to resource exhaustion and slowdown.
Risk Assessment
An attacker can perform a DoS attack, causing resource exhaustion and service unavailability.
Recommendation
Upgrade Apache Thrift to version 0.25.0 or later, which fixes the issue.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-96289High
Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.
- CVE-2026-96287High
Apache Thrift Perl bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive CPU or memory consumption.
- CVE-2026-96286High
Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.
- CVE-2026-96277High
Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.
- CVE-2026-94658High
Apache Thrift Lua bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive resource consumption.
- CVE-2026-94657High
Apache Thrift JavaME bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94656High
Apache Thrift Ruby bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94654High
Infinite loop vulnerability in Apache Thrift Python bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
- CVE-2026-85476High
Infinite loop vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
- CVE-2026-83745High
Vulnerability in Apache Thrift nodejs and D language bindings due to improper handling of length parameter, leading to excessive memory allocation. A small frame can cause allocation of up to 2 GiB. Affects versions before 0.25.0.
Original NVD description (English source)
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS