Apache Thrift dart bindings: Denial of service via unbounded string size in JSON protocol
Summary
The dart bindings of Apache Thrift, specifically the TJsonProtocol/TJSONProtocol components, do not limit the size of strings they process. A remote, unauthenticated attacker can send specially crafted input to a Dart application that parses Thrift JSON, which may exhaust memory and cause a denial of service. Code execution and data disclosure are not indicated by the CVSS vector.
Affected
- Apache Thrift before 0.25.0 (dart bindings)
- Some distribution packages up to thrift 0.24.0-1 (for example Debian bookworm, Azure Linux); check your build for this CVE.
Fixed in
- Apache Thrift 0.25.0 (released Sep 30, 2026)
- Distribution builds: Red Hat lists fixed builds as less than 0.25.0-1; use your distribution's advisory for exact package versions.
Workaround
- No vendor-published workaround is known.
- Limit the size of incoming Thrift JSON at the transport or application layer.
- Do not parse Thrift JSON from untrusted sources until patched.
Exploitation
- No evidence found of in-the-wild exploitation, public proof of concept or CISA KEV entry at the time of research.
- EPSS 0.00426 (low probability of exploitation).
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Identify Dart or Flutter projects and backends that use Apache Thrift (for example via pubspec.yaml inventories).
- Upgrade to Apache Thrift 0.25.0 or the distribution's fixed build.
- Where upgrading is not possible soon, apply input-size limits and avoid parsing untrusted Thrift JSON.
- Monitor the primary sources for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list thread (CVE record reference) lists.apache.org
- Apache Thrift mailing list thread (CVE record reference) lists.apache.org
- OSV: BIT-thrift-2026-94648 osv.dev
- Linux Security: Apache Thrift 0.25.0 message memory limits linuxsecurity.com
- Vulners: CVE-2026-94648 vulners.com
- Vulners: Red Hat RHSA-2026:74369 for CVE-2026-94648 vulners.com
- OSV: Debian CVE-2026-94648 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:18.
Original description (NVD)
Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.