Apache Thrift PHP: Inefficient algorithm enables denial of service
Summary
The PHP bindings of Apache Thrift (framed, memory and HTTP transports) re-slice the buffer on every read, which makes processing cost grow quadratically. A remote, unauthenticated attacker can send specially crafted input to exhaust resources and disrupt the affected service; only availability is impacted. The CVSS v4.0 base score is 8.2 (High), while Vulners rates the issue 5.7 (Medium).
Affected
- Apache Thrift before 0.25.0, PHP bindings (Composer package apache/thrift)
Fixed in
- Apache Thrift 0.25.0
- Distribution packages differ in fixed versions; check your vendor's advisory.
Workaround
- No vendor-published workaround. Upgrading to 0.25.0 is the fix.
Exploitation
- Not reported as exploited in the wild; not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, not automatable.
- No public exploit code has been confirmed.
Our recommendation
- Inventory PHP projects that use apache/thrift via Composer and check the locked version.
- Upgrade to Apache Thrift 0.25.0 or later, together with the other Thrift fixes from the same batch.
- Prioritise internet-facing or untrusted-network services; restrict client access to the Thrift PHP endpoint where upgrading is delayed.
- Monitor for abnormal CPU and memory usage on affected services.
- Check distribution packages separately, as fixed versions differ between vendors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list advisory (thread 1) lists.apache.org
- Apache mailing list advisory (thread 2) lists.apache.org
- Vulners: CVE-2026-94653 vulners.com
- OSV: DEBIAN-CVE-2026-94653 osv.dev
- Vulners: Red Hat RHSA-2026:74369 vulners.com
- Strix: CVE-2026-94653 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:15.
Original description (NVD)
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.