CVE-2026-94652
Received Received - Intake

Memory Leak in Apache Thrift C++ Bindings

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-94652
EUVD
EUVD-2026-91565

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in Apache Thrift's C++ bindings where memory is not released after its effective lifetime, potentially causing resource exhaustion.

Detection Guidance

This vulnerability is related to memory management in Apache Thrift C++ bindings. Detection requires checking the installed version of Apache Thrift. Run 'thrift --version' or check package managers like 'dpkg -l | grep thrift' or 'rpm -qa | grep thrift' to identify versions before 0.25.0.

Impact Analysis

It may lead to system slowdowns, crashes, or denial of service due to excessive memory consumption over time.

Compliance Impact

This vulnerability involves a memory leak in Apache Thrift c++ bindings, which could lead to resource exhaustion or instability in affected systems. While not directly tied to data privacy or security controls, such issues may indirectly impact compliance by affecting system reliability and availability. However, no specific information is provided about direct effects on GDPR, HIPAA, or other standards.

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later immediately. Use your package manager to update, e.g., 'apt-get upgrade thrift' or 'yum update thrift'. If upgrading is not possible, consider disabling affected C++ bindings or restricting network access to services using Thrift.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart