Apache Thrift CVE-2026-96286

The target must be a service that uses Apache Thrift's Perl bindings (version before 0.25.0) to parse or deserialize attacker-supplied input over the network. Exploitation requires no authentication (PR:N) and no user interaction (UI:N), but the CVSS 4.0 AT:P metric indicates a specific precondition must hold - the attacker must be able to deliver input that reaches the vulnerable Perl deserialization/handler path to trigger the uncaught exception. Impact is limited to availability (process/thread crash); there is no confidentiality or integrity effect, which bounds realistic risk to service disruption rather than data compromise. Deployments not using the Perl bindings are unaffected.

The authoritative CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.2) describes a network-reachable, unauthenticated denial-of-service: the only impact is availability (VA:H), with no confidentiality or integrity impact, consistent with CWE-248 (Uncaught Exception). The AT:P metric signals that a specific attack precondition must be met (the target must be a service that deserializes attacker-controlled data via the Perl bindings), which tempers the otherwise-high score. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.2 is driven by network reach and unauthenticated access, not by demonstrated real-world weaponization. Net: a credible availability risk for exposed Thrift-over-Perl services, but currently a crash/DoS rather than a code-execution or data-exposure priority. One conflict to flag: the input Tag 'Information Disclosure' contradicts the CVSS vector, which shows VC:N (no confidentiality impact) and VA:H (availability only) - treat this as a DoS, not an information-disclosure issue.

An attacker sends a malformed or unexpected message to a network-exposed service built on Apache Thrift's Perl bindings. The crafted input triggers an uncaught exception during processing, crashing the handling process or thread and denying service to legitimate clients. No public exploit code was identified in the provided data, and no authentication is required (PR:N).