Apache Thrift PHP CVE-2026-94644

Exploitation requires a network-reachable Apache Thrift service built on the PHP bindings at a version before 0.25.0, accepting messages from untrusted or attacker-controllable clients. The flaw is an unbounded resource allocation (CWE-770) in the PHP binding's message handling, so the limiting factor is the CVSS AT:P (Attack Requirements: Present) condition - the attacker must be able to supply input that drives the unbounded allocation (e.g., a server that reads attacker-specified sizes/collections without a cap). It is unauthenticated (PR:N) and needs no user interaction (UI:N), but impact is confined to availability (VA:H; VC:N/VI:N) - it cannot be used for data disclosure or code execution. Services that only accept trusted internal clients, or that already enforce external size/rate limits in front of the Thrift endpoint, face materially reduced real-world risk.

This is a denial-of-service issue (CWE-770, allocation of resources without limits or throttling) in the Apache Thrift PHP bindings prior to 0.25.0. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 (High) and indicates a network-reachable, low-complexity, unauthenticated attack affecting availability only - there is no confidentiality or integrity impact (VC:N/VI:N). The key moderating signal is AT:P (Attack Requirements: Present), meaning exploitation depends on specific conditions beyond pure default reachability rather than being a trivially universal flaw. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. In practical terms this is a genuine availability risk for internet-facing or untrusted-client-facing Thrift PHP services, but it is a resource-exhaustion DoS, not code execution or data compromise - the 8.2 score is driven almost entirely by the high availability impact combined with unauthenticated network reach. Conflict to note: the high base score should not be read as emergency-tier given the absence of exploitation signals (no KEV, no POC, no EPSS) and the DoS-only impact; prioritize patching but weight it as an availability hardening fix rather than a breach-prevention one.

A remote, unauthenticated attacker sends crafted or oversized Thrift protocol messages to a PHP-based Thrift service endpoint, causing the deserialization/parsing layer to allocate memory or resources without bound. The repeated or single malicious payload exhausts server memory or CPU, rendering the service unavailable to legitimate clients. No public exploit code was identified at time of analysis, and the CVSS AT:P metric implies the attacker must meet a specific precondition (e.g., a reachable endpoint accepting attacker-controlled message sizes) for reliable exploitation.