Apache Thrift CVE-2026-94657

Exploitation requires that the target run a service built on the Apache Thrift JavaME bindings at a version before 0.25.0 and accept attacker-reachable Thrift protocol input over the network. The flaw is specific to the JavaME bindings, not Thrift's other language runtimes, which sharply limits the exposed population. The CVSS Attack Requirement (AT:P) indicates a precondition beyond default reachability must hold, and impact is limited to availability (service outage) - there is no confidentiality or integrity exposure. Mitigation is straightforward: upgrade to 0.25.0.

This is a CWE-770 (uncontrolled resource allocation) denial-of-service issue in Apache Thrift's JavaME bindings, rated CVSS 4.0 base 8.2 (High). The vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with low complexity but a present Attack Requirement (AT:P), meaning exploitation depends on specific conditions beyond the attacker's full control (e.g., a service deployed on the affected JavaME binding accepting attacker-supplied input). Impact is confined to availability (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), which is consistent with a resource-exhaustion DoS rather than code execution or data compromise. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The score is driven by the high availability impact and network vector; however, the real-world priority is tempered by the fact that this affects only the JavaME (Java Micro Edition) bindings - a narrow, legacy subset of Thrift deployments - rather than the mainstream Java/C++/Python runtimes. The AT:P requirement and the limited affected surface suggest this is a genuine but lower-urgency fix for most environments: patch where JavaME bindings are in use, deprioritize elsewhere.

An attacker sends crafted or high-volume Thrift protocol messages to a network service built on the vulnerable Apache Thrift JavaME bindings, where resources are allocated without limits or throttling. The server allocates memory/resources unboundedly in response, exhausting available capacity and causing a denial of service. No public exploit code was identified in the provided data.