Apache Software FoundationCVE-2026-94636

Apache Thrift: improper quantity validation

High8.2CVE-2026-94636 · Published Oct 2, 2026

Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Software Foundation advisory

Affected versions

Package	Affected	Fixed in
Apache Thrift Product	< 0.25.0	0.25.0

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-409, CWE-628, CWE-1284

More Apache Software Foundation advisories

All Apache Software Foundation

Date	Advisory	Severity	Fixed in
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946550.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946560.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: resource exhaustion High8.2Oct 2 CVE-2026-946570.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-946540.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: infinite loop High8.2Oct 2 CVE-2026-854760.25.0	High8.2	0.25.0
Oct 2	Apache Thrift: integer overflow Critical9.2Oct 2 CVE-2026-836320.25.0	Critical9.2	0.25.0