Apache Thrift CVE-2026-96289

The target application must use the Apache Thrift PHP bindings (version before 0.25.0) and must parse/deserialize attacker-controllable Thrift messages - this is the specific prerequisite reflected by the CVSS 4.0 AT:P attack-requirement flag. The attacker needs no authentication (PR:N) or user interaction (UI:N) and can reach the service over the network (AV:N), but exploitation is limited to services that accept untrusted serialized Thrift input; internal services that only process trusted, bounded data are not realistically exposed. Impact is restricted to availability (process/worker crash); there is no path to data access or code execution via this flaw.

This is a denial-of-service vulnerability (CWE-674 Uncontrolled Recursion) in the Apache Thrift PHP bindings, rated 8.2 (High) under the provided CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N with impact confined to availability (VA:H; VC:N, VI:N). The network, low-complexity, unauthenticated profile makes it remotely reachable, but the AT:P (attack requirement present) flag signals that successful exploitation depends on the target actually parsing attacker-supplied Thrift data - it is not a trivially universal trigger. No EPSS score, SSVC decision data, KEV listing, or POC reference was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact ceiling is service disruption only - there is no code execution, data disclosure, or integrity loss per the vector. Net assessment: a credible, easily-triggered availability risk for services that deserialize untrusted Thrift messages in PHP, but not a confidentiality/integrity emergency; prioritize patching for internet-facing or multi-tenant Thrift PHP services over isolated internal ones. Note: the input Tags list 'Information Disclosure', which directly contradicts the availability-only CVSS impact (VC:N/VI:N/VA:H) - this appears to be a mislabel, and defenders should treat this as DoS, not disclosure.

An attacker sends a maliciously crafted, deeply-nested Thrift message to a network-exposed service built on the Apache Thrift PHP bindings. The recursive parser follows the nesting without bound, exhausting the stack or available resources and crashing the PHP worker, producing a denial of service. No authentication or user interaction is required, though the target must be configured to accept and deserialize the attacker's Thrift payload. No public POC was identified at time of analysis.