Apache Thrift (Python): Infinite loop in TNonblockingServer
Summary
The Python bindings of Apache Thrift before 0.25.0 contain an infinite loop in the non-blocking Python server (TNonblockingServer). A crafted frame whose size reaches an 8192-byte boundary causes the server to busy-loop and stop selecting all file descriptors. A network-reachable attacker can therefore cause a denial of service without credentials or user interaction, provided the Thrift service is exposed.
Affected
- Apache Thrift Python bindings (PyPI package thrift) before 0.25.0
- Default configurations are unaffected, according to the CNA.
Fixed in
- Upgrade to Apache Thrift 0.25.0 or later.
- Distribution builds reported as fixed in the research notes (not verified against vendor advisories): openSUSE python-thrift 0.25.0-1.1, Red Hat python3-thrift 0.25.0-0.1.hum1.
Workaround
Unknown.
- Interim measure (own assessment, not from a source): if an application uses the non-blocking Python server, restrict which networks can reach it until it is patched.
Exploitation
- No known exploitation in the wild. The CVE is reported as not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- EPSS 0.00413 (very low).
- No public proof of concept found; this does not rule one out.
Our recommendation
- Identify whether Python Thrift is present, for example via SBOM, 'pip show thrift' or container scans.
- Upgrade to 0.25.0 or the fixed distribution build where Thrift is used in an exposed service.
- Limit network access to internal or partner-only Thrift services until patched.
- Monitor for service hangs or high CPU usage on Thrift servers, and check the Apache advisories for further guidance.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread 1 lists.apache.org
- Apache mailing list thread 2 lists.apache.org
- Tenable CVE-2026-94654 www.tenable.com
- OpenCVE CVE-2026-94654 app.opencve.io
- OSV PYSEC-2026-3926 (related earlier issue) osv.dev
- SUSE CVE-2026-94654 (Vulners) vulners.com
- Red Hat RHSA-2026:74369 (Vulners) vulners.com
- PSIRT CVE-2026-94654 psirt.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:13.
Original description (NVD)
Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.