Apache Thrift: Inefficient regular expression complexity in Lua bindings
Summary
Apache Thrift before 0.25.0 contains a flaw in the Lua bindings. The header parser THttpTransport:_parseHeaders matches each header line with a backtracking regular expression, which scales quadratically with input length. An unauthenticated remote attacker can send crafted HTTP headers to exhaust CPU resources and cause a denial of service. The issue only matters where the Thrift Lua bindings are used.
Affected
- Apache Thrift before 0.25.0 (Lua bindings, THttpTransport header parsing)
- Thrift may be included indirectly as a transitive dependency
Fixed in
- Apache Thrift 0.25.0 (vendor fix)
- Distribution packages: fixed versions differ by distributor. SUSE lists 0.25.0-1 as fixed. Debian: Unknown.
Workaround
- No workaround is documented by the vendor.
- Interim measure (not from a source): restrict access to services that use the Thrift Lua bindings at network or reverse-proxy level and limit the HTTP header size.
Exploitation
- No in-the-wild exploitation reported.
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
- No confirmed public exploit code found.
Our recommendation
- Check whether any service uses Thrift with the Lua bindings. If not, exposure is limited.
- Inventory Thrift across all languages and dependencies, including SBOMs and transitive dependencies.
- Upgrade to Apache Thrift 0.25.0 or the fixed version from your distributor.
- Until patched, restrict network access to affected services and monitor for unusual CPU load or slow HTTP requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list advisory (thread 1) lists.apache.org
- Apache Thrift mailing list advisory (thread 2) lists.apache.org
- OSV record for CVE-2026-96292 (Debian) osv.dev
- SUSE CVE record for CVE-2026-96292 vulners.com
- Apache Thrift 0.25.0 security release overview linuxsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:16.
Original description (NVD)
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.