CVE-2026-94639CWE-248CWE-755CWE-770denial-of-service

CVE-2026-94639

published October 2, 2026

CVSS
8.2
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00426 · 35.8th percentile
Weaknesses
CWE-248 · Uncaught Exception; CWE-755 · Improper Handling of Exceptional Conditions; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-10-02T14:17Z
References (2)
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 · [email protected]https://lists.apache.org/thread/5okpz47dv8hy0s3r6tmrplg3y7jzhhyw · [email protected]
EPSS history
Timeline
  • 03 OCT 03:47Z
    EPSS moved — → 0%
    epss
  • 02 OCT 09:33Z
    Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
    cvelistv5