CVE-2026-94658
HighCVSS 8.7Summary
Apache Thrift Lua bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive resource consumption.
Risk Assessment
An attacker can perform a DoS attack, causing slowdown or unavailability of services.
Recommendation
Upgrade Apache Thrift to version 0.25.0 or later, which fixes the issue.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-96289High
Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.
- CVE-2026-96287High
Apache Thrift Perl bindings before version 0.25.0 have an inefficient algorithmic complexity vulnerability, which can lead to excessive CPU or memory consumption.
- CVE-2026-96286High
Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.
- CVE-2026-96277High
Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.
- CVE-2026-94657High
Apache Thrift JavaME bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94656High
Apache Thrift Ruby bindings before version 0.25.0 have an allocation of resources without limits or throttling vulnerability, which can lead to resource exhaustion.
- CVE-2026-94655High
Apache Thrift Lua bindings before version 0.25.0 have allocation of resources without limits or throttling and inefficient algorithmic complexity vulnerabilities, which can lead to resource exhaustion and slowdown.
- CVE-2026-94654High
Infinite loop vulnerability in Apache Thrift Python bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
- CVE-2026-85476High
Infinite loop vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0. Upgrade to 0.25.0 is recommended.
- CVE-2026-83745High
Vulnerability in Apache Thrift nodejs and D language bindings due to improper handling of length parameter, leading to excessive memory allocation. A small frame can cause allocation of up to 2 GiB. Affects versions before 0.25.0.
Original NVD description (English source)
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS