EUVD-2026-91330
GHSA-8x7g-5x7q-xx8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Thrift Lua RPC endpoint
-
ExploitSend message with inconsistent length field
-
ExecutionTrigger unbounded resource allocation
-
ImpactExhaust memory / crash service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run a service using the Apache Thrift Lua bindings at a version before 0.25.0 and expose that Thrift endpoint to the attacker over the network; the trigger is a protocol message whose length parameter is inconsistent with the actual data, abusing the missing allocation limit (CWE-770). The key limiting factor is scope: only the Lua language bindings are affected, so deployments using Thrift's other language bindings (C++, Java, Python, Go, etc.) are not impacted by this specific issue. No authentication or user interaction is required per the vendor vector (PR:N/UI:N), and impact is confined to availability - no data exposure or modification. |
| Impact | All available signals point to this being a genuine but bounded availability risk rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and the CWE-770 (unbounded resource allocation) plus the described length-parameter inconsistency are consistent with a remotely triggerable denial of service. Impact is explicitly availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity consequence, so the practical worst case is a crash or resource exhaustion of a service using the Thrift Lua bindings, not code execution or data compromise. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so exploitation likelihood cannot be quantified; the only exploitation signal is the structural one (network, no auth, low complexity), which means the score is driven by theoretical ease rather than observed activity. This is a real patch-worthy issue for anyone running the affected Lua bindings, but the availability-only impact and the narrow affected component (Lua bindings specifically, not all of Thrift) argue against treating it as an urgent, widespread crisis absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker who can reach a network service built on the Apache Thrift Lua bindings sends a crafted message whose declared length parameter is inconsistent with its actual payload, causing the deserializer to allocate memory or resources without limit. The service exhausts available memory or crashes, denying service to legitimate clients. No proof-of-concept exploit was provided in the input data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Denial of service in Apache Thrift's Lua language bindings (all versions before 0.25.0) allows unauthenticated remote attackers to drive unbounded resource allocation by sending protocol messages whose declared length parameter is inconsistent with the actual data, abusing a missing allocation limit (CWE-770). Per the vendor vector (PR:N/UI:N) no credentials or user interaction are required; impact is confined to availability (AV:N/AC:L/PR:N/UI:N with A:H, and no confidentiality or integrity effect), meaning memory or CPU exhaustion and likely process termination rather than data exposure or modification. Only deployments that expose a Thrift service implemented with the Lua bindings are in scope, so services built on Thrift's C++, Java, Python, Go and other bindings are not affected by this specific issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, and no EPSS score was supplied for this analysis.
RemediationAI
Vendor-released patch: Apache Thrift 0.25.0 - upgrade all Thrift deployments that use the Lua bindings to 0.25.0 as directed in the Apache advisories at https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 and https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3. If upgrading immediately is not possible, the most effective compensating control is to stop exposing the Lua-based Thrift service: bind the listener to localhost or to a management-only interface, or place it behind an authenticated reverse proxy and firewall rules that restrict access to trusted clients, accepting that this blocks legitimate remote callers and that any client able to reach the proxy is still able to trigger the flaw. A second option is to contain the blast radius with OS-level resource limits on the hosting process - cgroup memory caps, ulimit -v/-m, or an aggressive OOM policy plus automatic restart - with the trade-off that an attacker can still repeatedly kill or stall the service (the availability impact persists, it is merely scoped to one process rather than the host), and such limits must be tuned so that legitimate large requests do not fail. Note that although the CVSS vector lists PR:N/UI:N, deployment-level authentication and network segmentation are still useful as compensating measures since the vulnerability is unauthenticated by nature and cannot be mitigated by credential checks in the application logic. No vendor workaround replacing the 0.25.0 upgrade was identified in the provided data, and no vendor-released patch other than 0.25.0 should be assumed to exist.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC and serialization framework in which an IDL definition compiles into language-specific client and server bindings; the Lua bindings parse protocol frames that carry explicit length prefixes for strings, containers, and binary payloads. This issue is a compound weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) combined with improper handling of an inconsistent length parameter, so a crafted message can declare a length that does not match the bytes that follow, triggering a large or unbounded allocation or an extended read loop on the server side. The result is resource exhaustion in the Lua Thrift runtime - memory pressure, CPU burn, or an out-of-memory abort of the hosting Lua process - which directly explains the impact vector's A:H with C:N/I:N. Because the defect lives in the Lua binding's framing/allocation path rather than in the core protocol or in a shared, cross-language deserializer, the practical blast radius is limited to services that terminate Thrift traffic in Lua, even though the affected package identifier (CPE cpe:2.3:a:apache_software_foundation:apache_thrift:*:*:*:*:*:*:*:*) is tracked against the umbrella Apache Thrift product for all releases before 0.25.0.
Know when Apache Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remotely reachable RPC deserialization flaw triggered by a single crafted message with no auth or interaction (AV:N/AC:L/PR:N/UI:N); availability-only resource-exhaustion impact (A:H, C:N/I:N).
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Executive ViewAI
A high-severity availability flaw in Apache Thrift's Lua language bindings (all versions prior to 0.25.0) lets an unauthenticated remote attacker exhaust memory or CPU and terminate the affected service process by sending malformed protocol messages. Only systems that expose a Thrift service built with the Lua bindings are exposed; services using Thrift's C++, Java, Python, Go or other bindings are unaffected. Because the issue is availability-only, with no confidentiality or integrity impact, leadership should treat this as a service-continuity and SLA risk concentrated in a narrow, identifiable slice of the estate rather than as a data-breach event.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict memory and CPU limits (cgroups, ulimit) on Lua-binding Thrift processes and configure restart-on-failure; rate-limit and restrict network reachability of affected endpoints to trusted clients only; front affected services with a proxy that enforces maximum message sizes; disable or decommission unused Lua-binding services; and implement alerting on abnormal memory growth or process termination. Migrate to an unaffected Thrift binding or apply a local input-validation patch if Lua cannot be removed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Thrift
View allHeap-based buffer overflow in the C++ THeaderTransport of Apache Thrift before 0.25.0 lets a remote, unauthenticated att
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed i
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attack
Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a c
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed messa
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to c
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) let
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reach
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unau
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB