CVE-2026-94655 in Thrift
Summary
by MITRE • 10/02/2026
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The identified vulnerability represents a critical resource management flaw within the Lua bindings of the Apache Thrift framework, specifically affecting versions prior to 0.25.0. This issue is categorized under CWE-770: Allocation of Resources Without Limits or Throttling, which describes scenarios where an application allocates resources such as memory, CPU time, or network bandwidth without imposing adequate constraints on the quantity that can be consumed by a single user or process. In the context of Apache Thrift, a high-performance communication engine used to connect services across languages and platforms, efficient resource handling is paramount for maintaining system stability under load. The Lua bindings serve as an interface allowing Lua applications to interact with Thrift-based services, but they lacked sufficient safeguards against excessive consumption during specific operations or malformed inputs.
The technical root cause lies in the inefficient algorithmic complexity inherent in how certain data structures and serialization processes were handled within these older binding implementations. When processing large payloads or specifically crafted requests that trigger complex parsing routines, the underlying Lua code did not implement proper bounds checking or iterative limits on memory allocation loops. This inefficiency allows an attacker to induce a state of resource exhaustion by sending carefully constructed messages that force the interpreter into computationally expensive operations without termination conditions. Consequently, this can lead to significant performance degradation, where legitimate services are starved of necessary resources due to the disproportionate consumption caused by malicious or even unintentionally large requests.
From an operational perspective, the impact of this vulnerability is primarily centered on availability and service reliability. An attacker exploiting this flaw could execute a Denial-of-Service attack against any system relying on Apache Thrift Lua bindings for inter-process communication. By continuously sending payloads that trigger the inefficient algorithmic paths, the server process may consume excessive memory or CPU cycles, eventually leading to crashes or unresponsiveness. This is particularly dangerous in microservices architectures where high throughput and low latency are required, as a single compromised node can cascade into broader system instability if not properly isolated. The lack of throttling mechanisms means that even moderate volumes of malicious traffic could overwhelm the service capacity over time.
To mitigate this risk, organizations running Apache Thrift with Lua bindings must upgrade immediately to version 0.25.0 or later, where these allocation limits and algorithmic efficiencies have been addressed by the development team. In addition to upgrading, it is advisable to implement network-level rate limiting and input size restrictions at the load balancer or reverse proxy layer preceding the Thrift service. This provides a defense-in-depth strategy that prevents excessive resource consumption before it reaches the vulnerable application code. Furthermore, monitoring tools should be configured to alert on unusual spikes in memory usage or CPU utilization associated with Lua worker processes, enabling rapid detection and response to potential exploitation attempts aligned with ATT&CK techniques related to Resource Hijacking or Denial of Service.