CVE-2026-85494

Summary

Apache Thrift bindings are vulnerable to memory exhaustion and unhandled exceptions due to improper handling of length parameters and inefficient algorithms, potentially leading to denial of service.

Exploitability

Exploitation requires sending specially crafted data to a Thrift service that uses affected language bindings, with no complex preconditions needed.

Blast radius

The vulnerability could affect any application using Apache Thrift with Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP or D language bindings, potentially causing widespread service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Thrift version 0.25.0 which fixes the memory allocation and exception handling issues.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.