CVE-2026-94648 HIGH

CVE-2026-94648: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

Vendor Apache Software Foundation

Product Apache Thrift

Weakness CWE-770 · Uncontrolled resource consumption

Published October 2, 2026

Last update October 2, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Key dates

02Disclosure timeline

October 2, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-94648 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html AskarLabs — CWE-770 write-up Allocation of Resources Without Limits or Throttling

Related vulnerabilities

04Related CVE

CVE-2025-3734 Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035 CVE-2026-81285 WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability CVE-2025-48448 Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068 CVE-2025-3475 WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030 CVE-2025-4416 Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059