Apache Thrift PHP CVE-2026-94638

Exploitation targets services implemented with Apache Thrift's PHP bindings at versions before 0.25.0, where incoming data is deserialized/processed without resource limits or throttling (CWE-770). The attack is network-reachable and requires no authentication (PR:N) and no user interaction (UI:N), but the vendor's AT:P metric indicates a non-default or situational precondition beyond the attacker's control must be met for success, and the specific feature/configuration triggering unbounded allocation is not named in the advisory. Impact is limited to availability (VA:L) - no data compromise. The limiting factor is that only PHP-binding deployments on pre-0.25.0 versions are affected, and the attack requirement (AT:P) reduces reliability of exploitation.

This is a moderate-severity denial-of-service issue, not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated attack of low complexity, but with an attack requirement present (AT:P) - meaning successful exploitation depends on conditions beyond the attacker's full control - and the only impact is low availability (VA:L); there is no confidentiality or integrity impact and no scope change. This aligns with CWE-770 (allocation of resources without limits/throttling), a classic resource-exhaustion pattern. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public POC was provided, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. In short, the signals are internally consistent (network DoS, no high-value impact) and point to a real but lower-urgency fix: patch during normal maintenance rather than emergency change. The AT:P requirement and availability-only impact are the main factors tempering the 6.3 score.

An attacker with network access to a service built on Apache Thrift's PHP bindings sends crafted or high-volume requests that cause the server to allocate memory or other resources without bound, exhausting capacity and degrading or denying service to legitimate users. No authentication or user interaction is required, though the AT:P metric indicates some condition beyond the attacker's direct control must hold for the attack to succeed. No public proof-of-concept exploit was provided in the available data.