Description
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Published: 2026-10-02
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Resource Exhaustion
Action: Patch
AI Analysis

Impact

Apache Thrift's PHP `thrift_protocol` C extension ignores the configured `maxStringSize` setting, allowing an attacker to send extremely large strings that are allocated without any limits. The unchecked allocation can consume all available memory, potentially causing the server to become unresponsive and resulting in a denial of service. This flaw is classified under CWE‑770, indicating allocation of resources without limits.

Affected Systems

The vulnerability affects the Apache Thrift project distributed by the Apache Software Foundation. Versions before 0.25.0 are impacted; upgrading to 0.25.0 or later resolves the issue.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. It is inferred that an attacker could send crafted Thrift requests to trigger the unchecked memory allocation, potentially leading to resource exhaustion. The risk is mitigated by applying the vendor patch and configuring appropriate resource limits.

Generated by OpenCVE AI on October 2, 2026 at 14:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Thrift to version 0.25.0 or newer, which contains the fix for the maxStringSize check.
  • Set the maxStringSize configuration parameter to a value that limits the maximum length of incoming strings, ensuring it aligns with expected payload sizes.
  • Implement runtime resource limits such as PHP memory_limit or OS ulimit settings to prevent excessive memory consumption in case of a misconfiguration or malicious request.

Generated by OpenCVE AI on October 2, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 03 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Moderate

Fri, 02 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift

Fri, 02 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Title Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Apache Thrift
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-05T16:24:52.177Z

Reserved: 2026-09-21T22:56:37.878Z

Link: CVE-2026-94638

cve-icon Vulnrichment

Updated: 2026-10-05T16:24:45.240Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T12:17:23.453

Modified: 2026-10-05T17:17:17.413

Link: CVE-2026-94638

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-02T11:49:43Z

Links: CVE-2026-94638 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T14:44:17Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling