Apache Thrift: Quadratic-time buffer handling in Lua bindings
Summary
The Lua language bindings of Apache Thrift re-slice the buffer on every read in TFramedTransport and THttpTransport, which leads to quadratic processing time. A remote attacker who can send crafted input to a Lua service that parses Thrift data can cause excessive CPU usage and a denial of service. Only applications that use Thrift from Lua and accept untrusted network input are affected.
Affected
- Apache Thrift (Lua bindings) before 0.25.0
- Debian packages of thrift listed as affected up to 0.24.0 in bookworm and trixie
- Azure Linux 3 packages up to 0.24.0-1
- Ubuntu and other distributions: Unknown.
Fixed in
- Apache Thrift 0.25.0 (released Sep 30, 2026)
- Debian: No fixed package version found.
- Azure Linux 3 and Ubuntu: Unknown.
Workaround
No workaround is documented in the sources reviewed. Upgrading to Thrift 0.25.0 is the only documented remedy.
Exploitation
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact partial.
- No evidence of exploitation in the wild, no CISA KEV listing and no public proof of concept were found in the research. This is not a definitive negative.
- NVD status is listed as Deferred in the record provided.
Our recommendation
- Check whether any application or appliance in your environment uses Thrift from Lua. If not, the component is not in use.
- If it is in use, upgrade to Apache Thrift 0.25.0 or to a distribution package that includes the fix.
- Until patched, restrict network access to Thrift endpoints and enforce request size and timeout limits at the application or reverse proxy.
- Monitor these services for CPU spikes.
- Patch related CVE-2026-94655 and CVE-2026-96292 together with this issue.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list thread 1 lists.apache.org
- Apache Thrift mailing list thread 2 lists.apache.org
- OSV: Debian record CVE-2026-94658 osv.dev
- OSV: Bitnami record BIT-thrift-2026-94655 osv.dev
- OSV: Azure Linux record AZL-106596 osv.dev
- Linux Security: Apache Thrift 0.25.0 release linuxsecurity.com
- Rapid7 via Vulners: CVE-2026-94658 vulners.com
- Apache Thrift CHANGES.md apache.googlesource.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:47.
Original description (NVD)
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.