What is the CVSS score of CVE-2026-94642?

CVE-2026-94642 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-94642?

Within 24 hours, inventory every Apache Thrift deployment and isolate those running the PHP language binding on versions prior to 0.25.0, since the prerequisite for exploitation is use of the PHP bindings rather than other language bindings; for any such endpoint reachable from untrusted networks, immediately restrict access via edge firewall rules, IP allowlists, or an authenticated reverse proxy, and enable aggressive process supervision (systemd/supervisor restart policies, php-fpm max_requests and max_children limits) plus alerting on worker crashes so outages are detected and absorbed in seconds. Within 7 days, confirm vendor status for the Apache Thrift 0.25.0 release, which the advisory identifies as the version boundary for the fix, and schedule emergency change approval so upgrades can be deployed the day it publishes; in parallel, apply request-size and rate limits at the WAF or load balancer, disable any PHP Thrift listener that is not business-essential, and evaluate migrating exposed endpoints to a non-PHP binding where the protocol permits. Within 30 days, complete the upgrade to Apache Thrift 0.25.0 across all PHP-binding deployments or formally retire/rebind the affected services, re-test exposed endpoints after remediation, add crash-loop regression tests and monitoring to CI/CD, and update the vulnerability management SLA so unauthenticated availability-only flaws on internet-facing services are triaged within 24 hours going forward.

Apache Thrift CVE-2026-94642

Q: Which versions of Apache Thrift are affected by CVE-2026-94642?

A denial-of-service flaw in Apache Thrift's PHP language bindings lets anyone who can reach a PHP-based Thrift endpoint crash the PHP worker process without credentials, user interaction, or any…. A patch is available.

EUVD-2026-91408 HIGH

Uncaught Exception (CWE-248)

2026-10-02 apache

GHSA-q2f2-ff6q-g7p9

PHP Apache Information Disclosure Suse Apache Thrift Apache Software Foundation

8.7

CVSS 4.0 · Vendor: apache

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach network-exposed Thrift PHP endpoint
Exploit

Send malformed Thrift message
Execution

Trigger uncaught exception in bindings
Impact

Crash handler and deny service

Vulnerability Assessment

Weakness	CWE CWE-248 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Exception handling completeness
Exploitation Conditions	Exploitation requires a service that uses the Apache Thrift PHP bindings (version before 0.25.0) to process attacker-reachable Thrift protocol input over the network; sending malformed/unexpected data triggers an uncaught exception (CWE-248) in the PHP binding code. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, special privileges, or user interaction is needed against a default deployment that accepts untrusted Thrift messages. Limiting factors: the target must specifically use the PHP language bindings (other-language bindings are not in scope of this entry), run a vulnerable pre-0.25.0 version, and expose the Thrift endpoint to the attacker; impact is confined to availability (service crash/disruption), with no confidentiality or integrity consequence.
Impact	This is a genuine but bounded availability risk, not a confidentiality/integrity emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, unauthenticated, low-complexity trigger with no user interaction, and the single impact is availability (VA:H; VC:N, VI:N), consistent with CWE-248 (uncaught exception) causing a crash or request-processing failure in Apache Thrift's PHP bindings - a denial-of-service class issue. The 8.7 score is driven entirely by the ease of reach and the high availability impact, not by data exposure or code execution. No EPSS score, KEV listing, POC, or SSVC decision data is provided, so exploitation likelihood cannot be quantified from the input; absence of these signals is not evidence of active exploitation. Note a conflict: the input Tags include 'Information Disclosure,' but the authoritative CVSS vector records VC:N (no confidentiality impact) and VA:H, so the vulnerability is availability-only - the Information Disclosure label appears mislabeled and should be treated with skepticism. Net: prioritize patching on internet-facing or untrusted-input Thrift PHP services, but this is a DoS exposure rather than a data-breach or RCE priority.
Exploit ScenarioDerived	An attacker sends a malformed or unexpected Thrift message to a network service built on the Apache Thrift PHP bindings (prior to 0.25.0). The bindings fail to catch an exception while parsing the input, causing the request handler or worker process to terminate abnormally and interrupt service availability. No authentication or user interaction is required (PR:N/UI:N), and no public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 02, 2026

An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.

RemediationAI

Upgrade Apache Thrift to version 0.25.0, which is the vendor-released fix for this issue, and redeploy any PHP services that embed the PHP bindings (see the vendor threads at https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/5tjwbbyympbj16lblocv9b12s32sg113). Where an immediate upgrade is not possible, compensating controls are needed because the defect is availability-only: wrap thrift handler invocations and transport reads in application-level try/catch blocks so an uncaught exception cannot kill the worker (trade-off: unhandled input is silently dropped and must be logged to avoid masking attacks); front the Thrift endpoint with a reverse proxy or gateway that rejects malformed or oversized payloads before they reach PHP (trade-off: legitimate framing variations may be blocked and the proxy itself becomes a parsing surface); restrict the endpoint to trusted networks with ACLs or mTLS (trade-off: requires client-side changes and does not help endpoints that must be publicly reachable); and run PHP-FPM under a supervisor with bounded worker counts and request timeouts so crashed workers restart quickly and abuse is rate-limited (trade-off: repeated crashes still degrade throughput and can be used to sustain partial DoS). Note that no vendor-released patch exists for those who remain on pre-0.25.0 other than upgrading, and there is no indication of public exploit code driving urgency beyond hardening exposed endpoints.

Affected VersionsENISA

Apache Thrift 0 <0.25.0

Affected Packages

euvd apache_thrift fix: 0.25.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Apache Thrift is a cross-language RPC and serialization framework in which an IDL definition generates client/server stubs for many runtimes, including PHP. The vulnerability class is CWE-248 (Uncaught Exception): when the PHP binding code parses malformed, truncated, or otherwise unexpected Thrift protocol data, it raises an exception that the binding does not catch, so the exception propagates out of the request context and aborts the PHP worker or process handling the call. Because the failure is limited to error handling rather than memory corruption or protocol-level trust bypass, the impact maps purely to availability (VA:H with VC:N/VI:N in the CVSS 4.0 vector, and A:H with C:N/I:N in the independent 3.1 assessment). The CPE entry cpe:2.3:a:apache_software_foundation:apache_thrift:*:*:*:*:*:*:*:* uses a wildcard version, so it is broad and should be scoped with the vendor statement that only releases before 0.25.0 are affected; non-PHP language bindings are outside the scope of this entry.

Know when Apache Thrift gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today AI 7.5 HIGH

Remote unauthenticated malformed-input trigger with no interaction gives AV:N/AC:L/PR:N/UI:N; uncaught exception yields a crash so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Oct 02, 2026 - 12:02 EUVD

CVE Published

Oct 02, 2026 - 10:57 cve.org

HIGH 8.7

DescriptionCVE.org

Uncaught exception vulnerability in Apache Thrift PHP bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Executive ViewAI

Why It Matters

A denial-of-service flaw in Apache Thrift's PHP language bindings lets anyone who can reach a PHP-based Thrift endpoint crash the PHP worker process without credentials, user interaction, or any special network position, so affected services can be knocked offline repeatedly and cheaply. The exposure is confined to availability: there is no loss of confidentiality or integrity, meaning no customer data, credentials, or transactions are at risk from this issue alone. Leadership should care only if the organization operates PHP-served Thrift endpoints - typically internal microservice RPC or partner integrations - reachable from untrusted networks, where repeated worker termination can degrade or halt dependent business services until the fix ships.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of PHP-based Thrift endpoints to trusted sources via firewall rules, IP allowlists, or VPN/mTLS; front endpoints with an authenticated reverse proxy and enforce request-size and rate limits; run PHP workers under supervision with automatic restart and connection/child-process caps so crashes cause brief degradation rather than sustained outage; disable or retire non-essential PHP Thrift listeners; monitor and alert on worker termination and restart storms; and migrate exposed services to a non-PHP Thrift binding where feasible. Upgrade to Apache Thrift 0.25.0 once the vendor release is available.

Threat Intelligence Overview

EPSS Score

0.4%

Top 65% exploitable

Prevalence

Medium

Apache Thrift is widely used, but PHP-binding deployments are a narrower subset

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.