Apache Thrift EUVD-2026-91412

Exploitation requires that the target deployment actually use the Apache Thrift Lua bindings on a version before 0.25.0 and that attacker-controlled input reach the vulnerable regular-expression/parsing path. The CVSS 4.0 AT:P (attack requirements present) confirms exploitation is not fully attacker-controlled - a pathological input must be processed by the vulnerable Lua code path. The primary limiting factor is the narrow applicability: Thrift deployments using C++, Java, Python, Go, or other bindings are unaffected; only Lua-binding deployments are in scope. No authentication (PR:N) or user interaction (UI:N) is required where the service exposes the Lua-parsed interface to untrusted input.

This is a denial-of-service vulnerability (CWE-1333, inefficient regex/algorithmic complexity) in the Lua language bindings of Apache Thrift. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores it 8.2 (High), driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N). The AT:P flag is notable: it signals that successful exploitation requires conditions beyond the attacker's sole control - consistent with a ReDoS that only triggers when the vulnerable Lua binding actually parses attacker-influenced input. There is no CISA KEV listing and no EPSS score provided, and no public exploit was referenced, so there is no public exploit identified at time of analysis. The real-world priority is moderate rather than critical: the 8.2 score reflects worst-case remote unauthenticated availability loss, but the blast radius is constrained to deployments that specifically use the Thrift Lua bindings, which is a minority of Thrift usage. EPSS and KEV data are absent - not low, but missing - so exploitation likelihood cannot be quantified from the input; treat the High CVSS as a capped upper bound pending evidence that Lua bindings are in the exposed path.

A remote, unauthenticated attacker sends a specially crafted input string to a service that processes it through Apache Thrift's Lua bindings, triggering catastrophic regular-expression or algorithmic backtracking. The resulting CPU exhaustion stalls or hangs the request-handling thread, degrading or denying service to legitimate users. No public proof-of-concept was referenced in the available data.