Apache Thrift CVE-2026-94653

Requires an application that uses the Apache Thrift PHP bindings (version before 0.25.0) to deserialize or process Thrift protocol messages from untrusted or attacker-reachable sources. The CVSS 4.0 AT:P metric indicates a specific attack requirement must be satisfied to trigger the worst-case algorithmic path, so it is not a guaranteed-fire condition against every deployment. Exploitation is limited to deployments that actually expose Thrift parsing of untrusted input via the PHP library; services using other language bindings or not accepting untrusted Thrift input are not affected. Impact is confined to availability (resource exhaustion) - no data exposure or code execution.

This is a denial-of-service issue (CWE-407, Inefficient Algorithmic Complexity) in the Apache Thrift PHP bindings, not an information-disclosure or code-execution flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.2 and shows the impact is confined to availability (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) - the 'Information Disclosure' tag therefore contradicts the CVSS data and appears mislabeled. The vector is network-reachable, low-complexity, and requires no privileges or user interaction, but the AT:P (Attack Requirements: Present) metric signals that exploitation depends on a specific condition rather than firing against any default deployment, which moderates the raw severity. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Overall this is a credible availability risk for services that parse untrusted Thrift input via the PHP library, but it is a resource-exhaustion DoS rather than a high-urgency RCE/exploited-in-the-wild priority; prioritize patching where the PHP bindings face untrusted clients.

An attacker sends a specially crafted Thrift message to a network service that deserializes it using the vulnerable Apache Thrift PHP bindings. The malformed input triggers worst-case algorithmic behavior in the parser, consuming disproportionate CPU or memory and degrading or denying service to legitimate users. No public proof-of-concept is referenced, and the AT:P metric indicates a specific triggering condition must be met.