Apache Thrift CVE-2026-94648

Exploitation requires a network-reachable service built on Apache Thrift's Dart language bindings at a version before 0.25.0 that processes attacker-controlled Thrift messages. The flaw is specific to the Dart bindings, so deployments using other Thrift language bindings (C++, Java, Python, Go, etc.) are not affected by this issue. The CVSS Attack Requirements flag (AT:P) indicates a non-default precondition - practically, that the vulnerable Dart service must deserialize untrusted input - which limits exposure to internet- or untrusted-network-facing Dart Thrift endpoints. Impact is limited to availability (service disruption); there is no confidentiality or integrity consequence. The mitigation is upgrading to Apache Thrift 0.25.0.

This is a denial-of-service vulnerability (CWE-770, allocation of resources without limits or throttling) in the Dart language bindings of Apache Thrift. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 (High) and indicates a network-reachable, unauthenticated, low-complexity attack that affects only availability (VA:H) with no confidentiality or integrity impact - consistent with a resource-exhaustion DoS rather than code execution. The Attack Requirements metric is set to Present (AT:P), signaling that exploitation depends on some condition beyond a fully default state (e.g., a reachable Thrift service built on the vulnerable Dart bindings that deserializes attacker-controlled input). No EPSS score, CISA KEV listing, or public POC is present in the provided data: no public exploit identified at time of analysis, and there is no evidence of active exploitation. The signals are internally consistent (network DoS, availability-only impact) and point to a genuine but bounded issue: real priority for teams that expose Dart-based Thrift services to untrusted networks, but lower urgency than the raw 8.2 suggests for everyone else, given the availability-only impact, the AT:P requirement, and the absence of exploitation signals. The description does not quantify the resource consumed (memory, CPU, connections, or threads), so the precise exhaustion mechanism should be verified against the Apache advisories.

An attacker with network access to a service built on Apache Thrift's Dart bindings sends crafted or malformed Thrift protocol messages (for example, declaring very large collection/container sizes) that the server allocates without bounds or throttling. This drives memory or other resource exhaustion, degrading or crashing the service and denying it to legitimate clients. No authentication or user interaction is required, but the target must expose the vulnerable Dart-based Thrift endpoint; no public exploit code is known.