CVE-2026-94644

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-05

Assigner: Apache Software Foundation

Description

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94644

EUVD

EUVD-2026-91407

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Thrift 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is an allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. It allows an attacker to cause a denial of service by consuming excessive resources on the server.

Detection Guidance

This vulnerability is specific to Apache Thrift PHP bindings before version 0.25.0. To detect it, check the installed version of Apache Thrift using the command: thrift --version. If the version is below 0.25.0, the system is vulnerable. Additionally, inspect PHP applications using Thrift for improper resource allocation handling in network requests.

Impact Analysis

An attacker could exploit this to overload the server, leading to degraded performance or complete service unavailability. Systems using vulnerable versions of Apache Thrift PHP bindings are at risk.

Compliance Impact

The provided CVE does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves resource exhaustion in Apache Thrift PHP bindings, which could lead to denial-of-service conditions. Such conditions may indirectly affect compliance by disrupting availability of systems handling sensitive data, but no explicit compliance implications are mentioned.

Mitigation Strategies

Upgrade Apache Thrift PHP bindings to version 0.25.0 or later to address the allocation of resources without limits or throttling vulnerability.

Hi! I’m here to help you understand CVE-2026-94644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70