Apache Thrift EUVD-2026-91366

Exploitation requires a service that uses the Apache Thrift Dart bindings (version before 0.25.0) to deserialize attacker-supplied Thrift messages reachable over the network; the attacker must be able to send a message whose length/size parameter is set to an excessive value. No authentication or user interaction is required (PR:N/UI:N). The practical limiting factor is scope: only deployments using the Dart bindings specifically are affected, and impact is limited to availability (service crash/hang) - there is no data exposure or code execution.

The only severity signal available is the vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7), which describes a remotely reachable, unauthenticated, low-complexity flaw whose ONLY impact is availability (VA:H); confidentiality and integrity are explicitly N. This is consistent with CWE-789 (Memory Allocation with Excessive Size Value): an attacker-controlled length field drives an oversized allocation, exhausting memory and causing denial of service. No EPSS score, no CISA KEV entry, and no public exploit code are present in the input, so there is no evidence of active or imminent exploitation. Note a conflict: the 'Information Disclosure' tag contradicts the CVSS vector (VC:N means no confidentiality impact) - this is a DoS/availability issue, not disclosure, and the tag appears mislabeled. Net: a genuine, easily-triggered DoS in a specific language binding, but the availability-only impact and absence of exploitation signals place it below memory-corruption/RCE-class priorities. Prioritize patching where Dart Thrift services parse untrusted input.

An attacker sends a crafted Thrift message to a service built on the Apache Thrift Dart bindings, setting a length/size field to an excessively large value. The Dart parser allocates memory based on that unvalidated length, exhausting available memory and crashing or hanging the service (denial of service). No public exploit code is identified at time of analysis, and no authentication is required.