CVE-2026-94637

HighCVSS 8.2/10Last modified Oct 5, 2026

Description

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Metrics

CVSS 4.0 8.2/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-409

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-946386.3Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: beforCVE-2026-946398.2improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in ApachCVE-2026-94644.7A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/datCVE-2026-946407.5A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a laCVE-2026-946417.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows ReflectCVE-2026-946428.7Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommendedCVE-2026-946448.2Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: beforCVE-2026-946458.2Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodeCVE-2026-946468.7Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('CVE-2026-946488.2Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: befoCVE-2026-94657.3A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/CVE-2026-946508.2Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are reco
CVE-2026-94637: High severity, CVSS 8.2 | Vulnix