Apache Software FoundationCVE-2026-85494

Apache Thrift: excessive memory allocation

High8.7CVE-2026-85494 · Published Oct 2, 2026

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Software Foundation advisory

Affected versions

Package	Affected	Fixed in
Apache Thrift Product	< 0.25.0	0.25.0
	< 0.25.0	0.25.0
	< 0.25.0	0.25.0
	< 0.25.0	0.25.0
	< 0.25.0	0.25.0
	< 0.25.0	0.25.0
	< 0.25.0	0.25.0
	< 0.25.0	0.25.0
	< 0.25.0	0.25.0

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-130, CWE-248, CWE-407, CWE-789, CWE-1188

More Apache Software Foundation advisories

All Apache Software Foundation

Date	Advisory	Severity	Fixed in
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946550.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946560.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946570.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-946540.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-854760.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: integer overflow Critical9.2Oct 2 CVE-2026-836320.25.0	Critical9.2	0.25.0