Apache Thrift EUVD-2026-91569

Exploitation requires that the target service actually uses the Apache Thrift Lua language bindings at a version before 0.25.0 - services using Thrift's other language bindings are not affected. The attacker must deliver a specially crafted or malformed Thrift message that drives the uncontrolled resource allocation or worst-case algorithmic path; the CVSS AT:P (attack requirement present) metric confirms the trigger is conditional on such a payload rather than any arbitrary request. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the issue is network-reachable (AV:N), but impact is limited to availability - there is no path to data disclosure or code execution. The primary limiting factor is the narrow deployment surface: only Lua-binding deployments on vulnerable versions are exposed.

This is a denial-of-service vulnerability (CWE-770, uncontrolled resource allocation, plus inefficient algorithmic complexity) confined to the Lua bindings of Apache Thrift before 0.25.0. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) indicates a network-reachable, unauthenticated issue with no user interaction, but with an attack requirement present (AT:P) and impact limited strictly to availability (VA:H; no confidentiality or integrity impact). The 8.2/HIGH score is driven entirely by the availability impact being rated High combined with network reachability - there is no code execution or data exposure. No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or widespread weaponization; this reads as a real but bounded availability concern rather than an urgent emergency. The AT:P metric signals that exploitation is not fully unconditional - some attacker-side requirement (e.g., crafted/malformed Thrift payloads that trigger pathological allocation or algorithmic blowup) must be met. Practical risk is further narrowed because only deployments that actually use the Lua language bindings are affected, not the much larger population of Thrift users on other languages. Net: a legitimate DoS fix to apply, but not a high-real-risk code-execution event; prioritize behind any RCE/KEV items.

An unauthenticated remote attacker sends a crafted or malformed Thrift message to a service built on the Apache Thrift Lua bindings, causing unbounded memory allocation or worst-case algorithmic processing that exhausts CPU or memory and renders the service unavailable. No public exploit was identified at time of analysis, and the CVSS attack-requirement flag (AT:P) implies the payload must meet specific conditions to trigger the pathological path. Because AC:L, crafting such a request does not require defeating significant defensive mechanisms once those conditions are understood.