CVE-2026-94653

{
  "etk_id": "ETK-2026-348",
  "cve_id": "CVE-2026-94653",
  "display_id": "CVE-2026-94653",
  "ghsa_id": "GHSA-rh35-rp32-726p",
  "euvd_id": "EUVD-2026-91566",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Algorithmic complexity flaw in Apache Thrift PHP bindings",
  "summary": "Apache Thrift deployments using the PHP bindings before 0.25.0 are affected. An attacker may be able to cause disproportionate processing or resource consumption by supplying data for the vulnerable bindings to handle; the advisory does not specify further preconditions.",
  "mitigation": "Upgrade Apache Thrift to version 0.25.0 or later. Prioritize systems that accept untrusted data through the PHP bindings.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Thrift",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.25.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.25.0"
      ],
      "package_name": "apache/thrift",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0043,
  "epss_percentile": 0.3551,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 12.357545033333333,
  "t0_at": "2026-10-02T11:56:35.706000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T00:03:30.135451+00:00",
      "days": 0.5047966371643519,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T11:56:35.706000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-02T11:56:35.706000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T11:56:35.706000+00:00",
      "url": "https://github.com/advisories/GHSA-rh35-rp32-726p"
    }
  }
}