CVE-2026-94633

HighCVSS 8.7/10Last modified Oct 2, 2026

Description

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-130CWE-789

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-946348.2Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift PCVE-2026-946358.7Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift LuaCVE-2026-946368.2Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation ofCVE-2026-946378.2Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache ThCVE-2026-946386.3Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: beforCVE-2026-946398.2improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in ApachCVE-2026-94644.7A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/datCVE-2026-946407.5A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a laCVE-2026-946417.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows ReflectCVE-2026-946428.7Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommendedCVE-2026-946448.2Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: beforCVE-2026-946458.2Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift node
CVE-2026-94633: High severity, CVSS 8.7 | Vulnix