CVE-2026-94635: Apache Software Foundation Apache Thrift

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected products

• Apache Software Foundation Apache Thrift: before 0.25.0 (fixed in 0.25.0)

Published 2026-10-02. Last modified 2026-10-02.