CVE-2026-85493

{
  "etk_id": "ETK-2026-403",
  "cve_id": "CVE-2026-85493",
  "display_id": "CVE-2026-85493",
  "ghsa_id": "GHSA-95m7-jx48-r539",
  "euvd_id": "EUVD-2026-91402",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uncontrolled recursion in Apache Thrift Dart and Java ME bindings",
  "summary": "Apache Thrift Dart and Java ME bindings before 0.25.0 are affected by uncontrolled recursive processing. An attacker may be able to cause excessive recursion when the vulnerable processing path is reached; the advisory does not establish the access or input preconditions.",
  "mitigation": "Upgrade Apache Thrift Dart and Java ME bindings to version 0.25.0 or later. Until upgraded, reduce exposure to untrusted data processed through these bindings.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Thrift",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.25.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.25.0"
      ],
      "package_name": "dart bindings",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.25.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.25.0"
      ],
      "package_name": "java ME bindings",
      "purl": null
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0043,
  "epss_percentile": 0.3573,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.3673873,
  "t0_at": "2026-10-02T10:45:57.857000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T10:45:57.857000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T10:45:57.857000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85493"
    }
  }
}