CVE-2026-96289
Received Received - Intake

Uncontrolled Recursion in Apache Thrift PHP Bindings

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-96289
EUVD
EUVD-2026-91577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Uncontrolled Recursion vulnerability in Apache Thrift's PHP bindings. It allows an attacker to cause a stack overflow by sending specially crafted input, potentially leading to denial of service or arbitrary code execution.

Detection Guidance

To detect this vulnerability, check the version of Apache Thrift installed on your system. If it is before 0.25.0, the system is vulnerable. Use commands like 'thrift --version' or inspect package managers (e.g., 'dpkg -l | grep thrift' for Debian-based systems).

Impact Analysis

An attacker could exploit this to crash applications using vulnerable PHP bindings, disrupt services, or execute malicious code on affected systems. Systems running Apache Thrift before 0.25.0 are at risk.

Compliance Impact

The vulnerability is an uncontrolled recursion issue in Apache Thrift PHP bindings, which could lead to denial of service or resource exhaustion. This may impact compliance with standards like GDPR or HIPAA by disrupting availability of systems handling sensitive data, potentially violating requirements for data availability and security.

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later to address the uncontrolled recursion vulnerability in PHP bindings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart