CVE-2026-94635 in Thrift
Summary
by MITRE • 10/02/2026
Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified as an allocation of resources without limits or throttling within the Apache Thrift Lua bindings represents a significant resource exhaustion risk that can lead to denial-of-service conditions in affected systems. This flaw specifically stems from improper handling of length parameter inconsistencies during the processing of incoming data streams by the Lua interface layer of the framework. When Apache Thrift processes serialized messages, it relies on length fields embedded within the protocol structure to determine how much memory to allocate for deserialization and subsequent object instantiation. In versions prior to 0.25.0, the Lua bindings fail to adequately validate or bound these length parameters against system constraints such as available heap memory or configured maximum message sizes. This lack of validation allows an attacker to supply a maliciously crafted request with an excessively large length field that does not correspond to actual data size but triggers the allocation engine to reserve substantial amounts of memory based solely on the stated parameter value rather than verified payload integrity.
From a technical perspective, this issue aligns closely with CWE-770: Allocation of Resources Without Limits or Throttling and CWE-20: Improper Input Validation. The root cause lies in the absence of rigorous boundary checks before invoking memory allocation routines within the Lua virtual machine environment managed by Thrift. When a client sends a request where the declared length exceeds reasonable limits, the server-side binding attempts to allocate buffers proportional to this unbounded value. Because there is no throttling mechanism or upper limit enforcement on these allocations, repeated exploitation can rapidly deplete available system memory resources. This behavior creates a classic resource exhaustion scenario where legitimate users are denied service because the application becomes unresponsive due to out-of-memory errors or severe performance degradation caused by excessive garbage collection cycles and swapping activity.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity, although secondary effects such as data corruption could occur if memory allocation failures lead to undefined behavior in lower-level C libraries interfacing with Lua. An unauthenticated attacker can exploit this flaw remotely by sending specially crafted Thrift messages over the network. By continuously submitting requests with inflated length parameters, an adversary can induce a denial-of-service state that renders the affected service unavailable for legitimate traffic. This is particularly dangerous in high-throughput environments where Apache Thrift is commonly deployed as a core component of microservices architectures or RPC systems, as even partial resource exhaustion can cascade into broader system instability affecting dependent services and overall infrastructure reliability.
Mitigation strategies focus primarily on upgrading to Apache Thrift version 0.25.0 or later, which implements proper validation logic for length parameters before memory allocation occurs. In this updated release, the Lua bindings enforce strict limits on message sizes and validate that declared lengths are consistent with actual data availability, thereby preventing excessive resource consumption. For organizations unable to immediately upgrade, temporary mitigations include deploying network-level access control lists or web application firewalls to restrict incoming Thrift traffic from untrusted sources. Additionally, configuring operating system level memory limits for the process running the Lua bindings can provide a safety net by capping maximum memory usage per instance. It is also advisable to implement rate limiting at the load balancer or API gateway layer to throttle request volumes and reduce the likelihood of successful resource exhaustion attacks while patching efforts are underway.
This vulnerability maps to MITRE ATT&CK technique T1496: Resource Hijacking, specifically under sub-techniques involving CPU or memory consumption for denial-of-service purposes. Security teams should monitor system metrics such as heap usage, garbage collection frequency, and connection counts from external sources to detect potential exploitation attempts in real-time. Logging mechanisms should be configured to capture anomalies in message sizes received by the Thrift service, enabling forensic analysis if an incident occurs. Ensuring that all components of the technology stack are updated to supported versions remains the most effective long-term defense against this class of input validation and resource management flaws.