CVE-2026-94633
Received Received - Intake

Memory Corruption in Apache Thrift Dart Bindings

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-94633
EUVD
EUVD-2026-91366

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves memory allocation with an excessively large size value due to improper handling of length parameters in Apache Thrift Dart bindings. It affects versions before 0.25.0 and could lead to denial-of-service conditions or other memory-related issues.

Detection Guidance

Detection involves checking the version of Apache Thrift Dart bindings in use. Commands like 'dart pub deps' or examining the pubspec.yaml file can help identify the installed version. If the version is before 0.25.0, the system is vulnerable.

Impact Analysis

The vulnerability may cause applications using affected Apache Thrift Dart bindings to crash or become unresponsive due to excessive memory consumption. This could disrupt services relying on the library for data serialization and communication.

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later immediately. This can be done using package managers like 'dart pub upgrade' or by updating the dependency in the pubspec.yaml file and running 'dart pub get'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94633. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart