CVE-2026-94635 Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
HighCVSS 8.7
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/thrift-main(Red Hat:hummingbird:1) | < 0.25.0-0.1.hum1 | 0.25.0-0.1.hum1 |
| redhat/thrift(Red Hat:ceph_storage:7) | All versions | No fix listed |
| redhat/thrift(Red Hat:ceph_storage:8) | All versions | No fix listed |
| redhat/thrift(Red Hat:ceph_storage:9) | All versions | No fix listed |
| redhat/thrift(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| Apache Thrift | < 0.25.0 | 0.25.0 |
| debian/thrift(Debian:12) | All versions | No fix listed |
| debian/thrift(Debian:12) | = 0.17.0-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.17.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.17.0-4 | No fix listed |
| debian/thrift(Debian:12) | = 0.18.1-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.18.1-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-2.1 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-2.1~exp1 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.19.0-4 | No fix listed |
| debian/thrift(Debian:12) | = 0.20.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-2 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.22.0-4 | No fix listed |
| debian/thrift(Debian:12) | = 0.23.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.23.0-2 | No fix listed |
Show 32 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/thrift(Debian:12) | = 0.23.0-3 | No fix listed |
| debian/thrift(Debian:12) | = 0.24.0-1 | No fix listed |
| debian/thrift(Debian:12) | = 0.24.0-2 | No fix listed |
| debian/thrift(Debian:13) | All versions | No fix listed |
| debian/thrift(Debian:13) | = 0.19.0-4 | No fix listed |
| debian/thrift(Debian:13) | = 0.20.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-2 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-3 | No fix listed |
| debian/thrift(Debian:13) | = 0.22.0-4 | No fix listed |
| debian/thrift(Debian:13) | = 0.23.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.23.0-2 | No fix listed |
| debian/thrift(Debian:13) | = 0.23.0-3 | No fix listed |
| debian/thrift(Debian:13) | = 0.24.0-1 | No fix listed |
| debian/thrift(Debian:13) | = 0.24.0-2 | No fix listed |
| debian/thrift(Debian:14) | All versions | No fix listed |
| debian/thrift(Debian:14) | = 0.19.0-4 | No fix listed |
| debian/thrift(Debian:14) | = 0.20.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-2 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-3 | No fix listed |
| debian/thrift(Debian:14) | = 0.22.0-4 | No fix listed |
| debian/thrift(Debian:14) | = 0.23.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.23.0-2 | No fix listed |
| debian/thrift(Debian:14) | = 0.23.0-3 | No fix listed |
| debian/thrift(Debian:14) | = 0.24.0-1 | No fix listed |
| debian/thrift(Debian:14) | = 0.24.0-2 | No fix listed |
| ubuntu/thrift(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/thrift(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/thrift(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/thrift(Ubuntu:26.10) | All versions | No fix listed |
| azure linux mtools(Azure Linux:3.0) | < 0.25.0-1 | 0.25.0-1 |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:74369 patch vendor-advisory
- Red Hat Bugzilla 2544989 issue-tracking
- www.cve.org
- nvd.nist.gov
- lists.apache.org vendor-advisory
- lists.apache.org vendor-advisory
- Debian Security Tracker CVE-2026-94635 vendor-advisory
- Ubuntu CVE tracker vendor-advisory