CVE-2026-94655 — Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic

CVE-2026-94655

Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic PUBLISHED

Description (CNA)

Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Thrift	affected 0 before 0.25.0

CWE

CWE-770, CWE-407

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.