Apache Thrift EUVD-2026-91576

Exploitation requires that a target service use the Apache Thrift Perl bindings (versions before 0.25.0) to parse or deserialize attacker-controllable Thrift messages over the network. The AT:P metric confirms a specific attack requirement: the malicious input must reach the vulnerable parsing routine where the inefficient algorithmic complexity can be triggered. Limiting factors that reduce real-world exposure: only deployments using the Perl language bindings are affected (not Thrift services built on other languages such as Java, Python, C++, or Go), and the service must accept and process untrusted serialized input. Impact is limited to availability (resource exhaustion); there is no confidentiality or integrity compromise, and no authentication or user interaction is required to send the payload.

This is a denial-of-service (availability-only) issue, not a code-execution or data-exposure flaw. The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) indicates a network-reachable, unauthenticated, no-interaction attack with HIGH availability impact but ZERO confidentiality and integrity impact, which is fully consistent with CWE-407 (Inefficient Algorithmic Complexity). The 8.2 score is driven almost entirely by the VA:H availability dimension; the AT:P (Attack Requirements: Present) metric signals that exploitation is not entirely unconditional and depends on reaching the vulnerable Perl parsing/deserialization path with attacker-controlled input. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no evidence of active exploitation - no public exploit identified at time of analysis. Net assessment: this is a legitimately handled vendor advisory with a clean fix, but its real-world priority is moderate and constrained to deployments actually using the Apache Thrift Perl bindings; it is a worst-case resource-exhaustion DoS rather than a widespread, weaponized threat. NOTE: the input Tags include 'Information Disclosure', which directly conflicts with the CVSS vector (VC:N - no confidentiality impact) and the CWE-407 classification; the tag appears mislabeled and should not drive triage.

An attacker sends a specially crafted Thrift message to a network service that deserializes/parses untrusted input using the Apache Thrift Perl bindings. The malicious payload triggers worst-case algorithmic complexity in the parsing routine, causing disproportionate CPU/time consumption that exhausts the service's resources and renders it unresponsive. No public exploit code was identified in the provided intelligence; the AT:P metric indicates the attacker must reach the specific vulnerable parsing path.