Apache Thrift CVE-2026-94652

Exploitation requires a deployed service using the Apache Thrift C++ bindings (version before 0.25.0) that is reachable by the attacker and exercises the leaking code path. The AT:P metric indicates a specific attack requirement: the vulnerable code path must be triggered repeatedly so that unfreed memory accumulates to a service-affecting level, meaning a single request is insufficient and transient low-traffic services are far less at risk. Limiting factors: impact is confined to availability (no data exposure or code execution), effect is gradual rather than instantaneous, and services that recycle/restart worker processes or cap memory may blunt the leak. Non-C++ Thrift bindings are not affected.

This is a medium-severity availability issue, not a high-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) and the 6.3 base score are driven entirely by a low availability impact (VA:L) with no confidentiality or integrity impact (VC:N/VI:N) - consistent with CWE-401 (missing release of memory after effective lifetime), i.e. a memory leak leading to gradual resource exhaustion rather than code execution or data theft. The AT:P metric (attack requirement present) signals that exploitation is not simply fire-and-forget: a specific condition or repeated triggering is needed to accumulate enough leaked memory to degrade or crash the service. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' NOTE A CONFLICT TO VERIFY: the input Tags label this 'Information Disclosure,' but the CVSS vector sets VC:N (no confidentiality impact) and the CWE is a memory leak, so the tag appears mislabeled - the real impact is denial of service, not disclosure. Overall this is a legitimate but low-urgency DoS-class hardening fix, best handled via normal patch cycles unless the affected service is internet-exposed and handles high request volumes.

A remote, unauthenticated attacker repeatedly sends crafted or malformed requests to a service built on Apache Thrift's C++ bindings, each triggering a code path that fails to free allocated memory. Over sustained traffic the leaked memory accumulates until the process exhausts available RAM and crashes or is OOM-killed, causing a denial of service. No public exploit code was identified, and the AT:P requirement means a specific triggering condition must be met repeatedly rather than a single request.