Apache Thrift CVE-2026-94656

Requires a network-reachable service that uses the Apache Thrift Ruby bindings (version before 0.25.0) to deserialize messages from untrusted clients; the flaw triggers when such a service parses attacker-controlled input whose declared structure/container sizes cause unbounded resource allocation. Exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), but the CVSS 4.0 AT:P metric indicates a specific attack requirement - the endpoint must actually accept and parse untrusted Thrift messages. Limiting factors: only services exposing Thrift Ruby endpoints to untrusted input are affected, impact is confined to availability (no data disclosure or modification), and deployments that front Thrift with size/rate limits or that only accept trusted internal traffic materially reduce exposure.

This is a CWE-770 (allocation of resources without limits/throttling) denial-of-service flaw in the Ruby bindings of Apache Thrift, scored 8.2 (High) under CVSS 4.0 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H. The signals are internally consistent and point to a network-reachable, unauthenticated availability-only issue: VC:N/VI:N mean no confidentiality or integrity exposure, while VA:H reflects full availability loss (resource/memory exhaustion). The AT:P (attack requirement present) metric is the key moderating signal - exploitation is not purely trivial against any deployment; it depends on a reachable Thrift Ruby endpoint that deserializes attacker-controlled messages. No EPSS score was provided, the CVE is NOT on CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis - the 8.2 rating is driven by impact and reachability rather than observed exploitation. Net assessment: a genuine availability concern for services that expose Thrift Ruby endpoints to untrusted input, but a lower operational priority than a code-execution or data-exposure bug of similar score, and it should be patched as part of normal maintenance rather than treated as emergency. Missing data to note explicitly: EPSS probability is absent and exploitation maturity is unknown, so real-world exploitation likelihood cannot be quantified from the provided data.

An attacker who can reach a service built on the Apache Thrift Ruby bindings sends crafted messages (e.g., declaring very large collection/container sizes) that the parser allocates without enforcing limits, driving memory/CPU exhaustion. Repeated or sustained requests exhaust server resources and crash or hang the service, denying availability to legitimate clients. No public exploit code is referenced in the provided data.