Apache Thrift CVE-2026-92834

Exploitation requires the target to be running the Apache Thrift C++ WebSocket server component specifically (not the default binary/framed socket transports) at a version before 0.25.0, and requires the attack-requirement condition encoded as AT:P - a specific server state or race/timing condition must be present, so exploitation is not reliably repeatable against all requests. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the narrow component scope and the AT:P precondition substantially limit the realistically exploitable population. Impact is confined to low integrity effects (wrong status code / uninitialized data in responses) with no confirmed availability impact.

This is a moderate-severity, low-priority issue rather than an urgent one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw, but two signals pull the real-world risk down sharply: AT:P indicates a specific attack requirement (e.g. a race or timing/state condition) must be present for exploitation, and the impact metrics are minimal - VC:N (no confidentiality impact), VI:L (low integrity), VA:N (no availability impact). The 6.3 base score is therefore driven by reachability, not by consequence. No CISA KEV listing and no public exploit were provided, so there is no evidence of active exploitation or weaponization. Note a conflict worth flagging: the CVE is tagged 'Information Disclosure' and CWE-908 (use of uninitialized resource) typically implies memory disclosure, yet the vendor scored VC:N and only VI:L - verify with the Apache advisory whether any data leakage actually occurs, because the tag and the scored impact disagree. EPSS was not supplied. Overall: a real defect worth patching on a normal cycle, not an emergency.

An unauthenticated remote attacker opens connections to an exposed Apache Thrift C++ WebSocket server and sends traffic crafted to hit the vulnerable code path, triggering use of an uninitialized resource and/or return of an incorrect status code. Because the vector carries AT:P, success depends on a specific condition being met (such as a race or particular server state), limiting reliability. No public exploit code was identified at time of analysis.