Apache Thrift CVE-2026-94658

Exploitation requires that the target application use the Apache Thrift Lua bindings (version before 0.25.0) to deserialize or parse input that an attacker can influence over the network. The defining prerequisite is the use of the Lua language binding specifically - deployments using other Thrift language bindings are not affected by this issue. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are required once the Lua binding is exposed to attacker-controlled input; the primary limiting factor is simply whether the Lua binding is in use and reachable, and impact is confined to availability (service disruption), not data compromise.

This is an algorithmic-complexity denial-of-service flaw (CWE-407) in the Apache Thrift Lua bindings. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated condition requiring no user interaction, and the impact is strictly availability (VA:H) with no confidentiality or integrity impact (VC:N/VI:N). The 8.7 score is driven entirely by the ease-of-access metrics combined with high availability impact - it is a resource-exhaustion/DoS issue, NOT code execution or data exposure. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by scope: only applications that actually use the Thrift Lua bindings to parse attacker-influenced input are affected, which is a narrow subset of Thrift deployments. CONFLICT TO NOTE: the input Tag 'Information Disclosure' contradicts the CVSS vector (VC:N means no confidentiality impact) and the CWE - this is an availability/DoS issue, and the tag appears mislabeled. Net assessment: a genuine but moderate-priority availability risk for the specific deployments using Lua bindings, not a widespread critical emergency.

An attacker sends specially crafted input to a network service that deserializes Thrift messages using the vulnerable Lua bindings, triggering worst-case algorithmic behavior that consumes excessive CPU or memory. Because the flaw requires no authentication and no user interaction (AV:N/PR:N/UI:N), a single or small number of malicious requests can exhaust resources and render the service unavailable. No public proof-of-concept was identified in the provided intelligence.