CVE-2026-96292
Received Received - Intake

Inefficient Regex Complexity in Apache Thrift Lua Bindings

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-96292
EUVD
EUVD-2026-91412

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is due to inefficient regular expression and algorithmic complexity in Apache Thrift's Lua bindings. It can cause excessive CPU usage when processing certain inputs, potentially leading to denial of service.

Detection Guidance

Detection involves checking the Apache Thrift Lua bindings version. Use commands like 'thrift --version' or inspect installed packages via 'pip show thrift' or 'luarocks list' to verify if the version is before 0.25.0.

Impact Analysis

An attacker could exploit this to consume excessive server resources, causing slowdowns or crashes. Systems using affected Apache Thrift versions may become unresponsive under malicious input.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it involves inefficient algorithmic complexity in Apache Thrift Lua bindings rather than data exposure or privacy issues.

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later. Follow the official Apache Thrift upgrade instructions for your system. Remove or disable Lua bindings if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart