MajorCritical vulnerability

CVE-2026-94655 (CVSS 8.2)

NVD · officialPublished Oct 2, 2026Risk 37/100

Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Technical details

CVSS

8.2

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source