CVE-2026-85494

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85494", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-03T22:20:40.267Z", "datePublished": "2026-10-02T10:42:44.813Z", "dateUpdated": "2026-10-07T22:06:51.804Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-02T10:42:44.813Z"}, "title": "Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)", "problemTypes": [{"descriptions": [{"description": "CWE-130 Improper handling of length parameter inconsistency", "lang": "en", "cweId": "CWE-130", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-248 Uncaught exception", "lang": "en", "cweId": "CWE-248", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-407 Inefficient Algorithmic Complexity", "lang": "en", "cweId": "CWE-407", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-789 Memory allocation with excessive size value", "lang": "en", "cweId": "CWE-789", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-1188 Initialization of a resource with an insecure default", "lang": "en", "cweId": "CWE-1188", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageURL": "pkg:pypi/thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://pypi.python.org", "packageName": "thrift"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageURL": "pkg:gem/thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://rubygems.org", "packageName": "thrift"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageName": "erlang bindings", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageName": "lua bindings", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageName": "dart bindings", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageName": "javaME bindings", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageName": "D bindings", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageURL": "pkg:cpan/Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://cpan.org/modules", "packageName": "Thrift"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "packageURL": "pkg:composer/apache/thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://packagist.org", "packageName": "apache/thrift"}], "descriptions": [{"value": "Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings.</p><p>This issue affects Apache Thrift: before 0.25.0.</p><p>Users are recommended to upgrade to version 0.25.0, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1", "tags": ["vendor-advisory"]}, {"url": "https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Ho1aAs <xxy010605@gmail.com> for py, rb, erl, lua, dart, javame, d bindings", "type": "finder"}, {"lang": "en", "value": "Perl/PHP bindings were found by the Apache Thrift project's own cross-language sweep", "type": "finder"}, {"lang": "en", "value": "The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Thrift.", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T20:56:06.927521Z", "id": "CVE-2026-85494", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T22:06:51.804Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-85494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T20:56:06.927521Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T20:56:30.492Z"}}], "cna": {"title": "Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ho1aAs <xxy010605@gmail.com> for py, rb, erl, lua, dart, javame, d bindings"}, {"lang": "en", "type": "finder", "value": "Perl/PHP bindings were found by the Apache Thrift project's own cross-language sweep"}, {"lang": "en", "type": "finder", "value": "The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Thrift."}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageURL": "pkg:pypi/thrift", "packageName": "thrift", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageURL": "pkg:gem/thrift", "packageName": "thrift", "collectionURL": "https://rubygems.org", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageName": "erlang bindings", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageName": "lua bindings", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageName": "dart bindings", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageName": "javaME bindings", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageName": "D bindings", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageURL": "pkg:cpan/Thrift", "packageName": "Thrift", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Thrift", "versions": [{"status": "affected", "version": "0", "lessThan": "0.25.0", "versionType": "semver"}], "packageURL": "pkg:composer/apache/thrift", "packageName": "apache/thrift", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1", "tags": ["vendor-advisory"]}, {"url": "https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings.</p><p>This issue affects Apache Thrift: before 0.25.0.</p><p>Users are recommended to upgrade to version 0.25.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-130", "description": "CWE-130 Improper handling of length parameter inconsistency"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248 Uncaught exception"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407 Inefficient Algorithmic Complexity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory allocation with excessive size value"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Initialization of a resource with an insecure default"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-02T10:42:44.813Z"}}}, "cveMetadata": {"cveId": "CVE-2026-85494", "state": "PUBLISHED", "dateUpdated": "2026-10-07T22:06:51.804Z", "dateReserved": "2026-09-03T22:20:40.267Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-02T10:42:44.813Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "thrift", "packageURL": "pkg:pypi/thrift", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://rubygems.org", "defaultStatus": "unaffected", "packageName": "thrift", "packageURL": "pkg:gem/thrift", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "erlang bindings", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "lua bindings", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "dart bindings", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "javaME bindings", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "D bindings", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Thrift", "packageURL": "pkg:cpan/Thrift", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "packageName": "apache/thrift", "packageURL": "pkg:composer/apache/thrift", "product": "Apache Thrift", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "0.25.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."}], "id": "CVE-2026-85494", "lastModified": "2026-10-07T23:17:00.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85494", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T20:56:06.927521Z", "version": "2.0.3"}}]}, "published": "2026-10-02T11:17:36.010", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-130"}, {"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-407"}, {"lang": "en", "value": "CWE-789"}, {"lang": "en", "value": "CWE-1188"}], "source": "security@apache.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:74369", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "thrift-main-0.25.0-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-01T00:00:00Z"}], "bugzilla": {"description": "thrift: thrift: Denial of Service via improper message handling in language bindings", "id": "2545019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545019"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-130", "details": ["A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger application crashes or excessive resource consumption, rendering the service unavailable."], "name": "CVE-2026-85494", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Affected", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Affected", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Affected", "package_name": "thrift", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "thrift", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-10-02T10:42:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85494\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85494\nhttps://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1\nhttps://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.25.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Thrift", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "thrift", "vendor": "apache"}], "created": "2026-10-02T14:00:18.959814+00:00", "title": "Apache Thrift Improper Length Validation Causes Remote Denial of Service", "updated": "2026-10-02T15:30:11.580128+00:00", "vendors": ["apache", "apache$PRODUCT$thrift"]}