CVE-2026-94635

{
  "etk_id": "ETK-2026-326",
  "cve_id": "CVE-2026-94635",
  "display_id": "CVE-2026-94635",
  "ghsa_id": "GHSA-8x7g-5x7q-xx8p",
  "euvd_id": "EUVD-2026-91330",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Resource exhaustion in Apache Thrift Lua bindings",
  "summary": "Apache Thrift Lua bindings before 0.25.0 mishandle inconsistent length parameters and may allocate resources without adequate limits. An attacker who can provide protocol input to an application using the affected bindings may cause resource exhaustion.",
  "mitigation": "Upgrade Apache Thrift Lua bindings to version 0.25.0. Limit exposure of services that accept untrusted Thrift input until the upgrade is complete.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Thrift",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.25.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.25.0"
      ],
      "package_name": "lua bindings",
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0043,
  "epss_percentile": 0.3552,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 89.80532543333334,
  "t0_at": "2026-10-02T09:07:56.691000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T09:07:56.691000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T09:07:56.691000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94635"
    }
  }
}