CVE-2026-93926CWE-401CWE-772

CVE-2026-93926

published October 2, 2026

CVSS
8.7
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00426 · 35.8th percentile
Weaknesses
CWE-401 · Missing Release of Memory after Effective Lifetime; CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-10-02T15:17Z
References (2)
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 · [email protected]https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb · [email protected]
EPSS history
Timeline
  • 04 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 02 OCT 10:13Z
    Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
    cvelistv5