Which versions of Apache Thrift are affected by CVE-2026-85494?

Apache Thrift versions before 0.25.0 are affected by a high-severity denial-of-service vulnerability that can crash or exhaust services built with several language bindings, disrupting availability…. A patch is available.

How to fix or mitigate CVE-2026-85494?

Vendor-released patch: 0.25.0. Within 24 hours, inventory all services using Apache Thrift and identify those running affected bindings (Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, D); apply the vendor-released patch 0.25.0 where feasible, and if immediate upgrade is not possible, implement interim mitigations such as network segmentation, rate limiting, input validation, and enhanced monitoring for malformed Thrift protocol data. Within 7 days, upgrade all affected Apache Thrift instances to 0.25.0, update dependency manifests and SBOMs, and test applications for compatibility. Within 30 days, verify no vulnerable Apache Thrift versions remain across production and development environments, audit third-party dependencies, and establish continuous monitoring for anomalous traffic targeting Thrift endpoints.

Apache Thrift CVE-2026-85494

Q: What is the CVSS score of CVE-2026-85494?

CVE-2026-85494 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-91401 HIGH

Improper Handling of Length Parameter Inconsistency (CWE-130)

2026-10-02 apache

GHSA-26jj-r8fx-8pm3

PHP Python Apache Information Disclosure Red Hat Suse Apache Thrift Apache Software Foundation

8.7

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remotely reachable malformed input needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); weaknesses cause crash/resource exhaustion only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Oct 02, 2026 - 12:02 EUVD

Analysis Generated

Oct 02, 2026 - 11:31 vuln.today

CVE Published

Oct 02, 2026 - 10:42 cve.org

HIGH 8.7

DescriptionCVE.org

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Articles & Coverage 1

News 7 New Python Vulnerabilities - 7 High Severity Oct 03, 2026

AnalysisAI

Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to crash or exhaust services running affected language bindings by sending malformed Thrift protocol data. The flaw combines improper length-parameter handling with excessive memory allocation, inefficient algorithmic complexity, uncaught exceptions, and insecure default initialization across the Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, and D bindings. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The affected application must parse Thrift-serialized protocol data received from an untrusted or network-reachable source using one of the vulnerable language bindings (Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP, or D) on a version before 0.25.0; the 'insecure default initialization' weakness implies default configurations are exposed without needing special feature flags. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a denial-of-service class vulnerability, not a code-execution or data-exposure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Apache Thrift 0.25.0, which fixes the issue for all affected language bindings. … Detailed patch versions, workarounds, and compensating controls in full report.