CVE-2026-94655: DoS

Description

Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Is your site exposed to CVE-2026-94655?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-407 CWE-407

CWE-770 CWE-770

References

Other References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt

Frequently Asked Questions

What is CVE-2026-94655? +

Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

How do I check if I'm vulnerable to CVE-2026-94655? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42245

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has …

CVE-2026-102997

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode …

CVE-2026-96287

Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to …

CVE-2026-103604

Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy Castle Inc. bc-csharp …

CVE-2026-94658

Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to …

CVE-2026-49250

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until …

CVE-2026-94655