CVE-2026-94636CWE-1284CWE-409CWE-628

CVE-2026-94636

published October 2, 2026

CVSS
8.2
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00426 · 35.8th percentile
Weaknesses
CWE-1284 · Improper Validation of Specified Quantity in Input; CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification); CWE-628 · Function Call with Incorrectly Specified Arguments
Published
2026-10-02T16:17Z
References (2)
https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs · [email protected]https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 · [email protected]
EPSS history
Timeline
  • 04 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 02 OCT 11:47Z
    Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up
    cvelistv5