CVE-2026-94639

HighCVSS 8.2/10Last modified Oct 5, 2026

Description

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Metrics

CVSS 4.0 8.2/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-248 CWE-755 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-94644.7A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/dat CVE-2026-946407.5A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a la CVE-2026-946417.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflect CVE-2026-946428.7Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended CVE-2026-946448.2Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: befor CVE-2026-946458.2Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift node CVE-2026-946468.7Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('CVE-2026-946488.2Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: befo CVE-2026-94657.3A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/CVE-2026-946508.2Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are reco CVE-2026-946517.5improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindin CVE-2026-946526.3Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before