PT-2026-104181

CVE-2026-94635

Published

2026-10-02

Updated

2026-10-09

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0

Description Improper handling of length parameter inconsistency and allocation of resources without limits or throttling in Apache Thrift Lua bindings. Specifically, the TBinaryProtocol:readMessageBegin() function bypasses checkStringSize() on the pre-versioned name.

Recommendations Upgrade to version 0.25.0.

Exploitability

Fix

Impacts

Researchers

Ho1Aas

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-130: Improper Handling of Length Parameter Inconsistency

Related identifiers