CVE-2026-94653— Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
Quick assessment
Affected
Apache Software Foundation Apache Thrift
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Thrift PHP 绑定中存在低效的算法复杂度漏洞。 此问题影响 Apache Thrift 0.25.0 之前的版本。 建议用户升级到版本 0.25.0，该版本已修复此问题。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94653
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)
Source: CVE Program / CVE List V5
Vulnerability Description
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Thrift | 0 ~ 0.25.0 | - |
|
II. Public POCs for CVE-2026-94653
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94653
请登录查看更多情报信息。
Other References for CVE-2026-94653 (2)
-
https://lists.apache.org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4m vendor-advisory
-
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-10-02 · 56 CVEs total
| CVE-2026-91135 | 9.2 CRITICAL | Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) |
| CVE-2026-94635 | 8.7 HIGH | Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pr |
| CVE-2026-94658 | 8.7 HIGH | Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read ( |
| CVE-2026-94646 | 8.7 HIGH | Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two tri |
| CVE-2026-96277 | 8.7 HIGH | Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception |
| CVE-2026-87117 | 8.7 HIGH | Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element |
| CVE-2026-86537 | 8.7 HIGH | Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthen |
| CVE-2026-86535 | 8.7 HIGH | Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely |
| CVE-2026-83745 | 8.7 HIGH | Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from th |
| CVE-2026-96294 | 8.7 HIGH | Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection |
| CVE-2026-61373 | 8.7 HIGH | Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation |
| CVE-2026-94642 | 8.7 HIGH | Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception |
| CVE-2026-85493 | 8.7 HIGH | Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth |
| CVE-2026-85494 | 8.7 HIGH | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, |
| CVE-2026-91137 | 8.7 HIGH | Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements |
| CVE-2026-93925 | 8.7 HIGH | Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative |
| CVE-2026-93926 | 8.7 HIGH | Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error pa |
| CVE-2026-94633 | 8.7 HIGH | Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned na |
| CVE-2026-82458 | 8.7 HIGH | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, |
| CVE-2026-94651 | 8.2 HIGH | Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a p |
Showing top 20 of 56 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Thrift
-
CVE-2026-83745
Apache Thrift, Apache Thrift: WebSocket frame decoders alloc -
CVE-2026-85476
Apache Thrift: c_glib `read_all` spins when the underlying r -
CVE-2026-96289
Apache Thrift: php `--gen php:inlined` struct readers (and ` -
CVE-2026-96287
Apache Thrift: Perl `FramedTransport` reads and TLS socket w -
CVE-2026-96286
Apache Thrift: Perl servers end `serve()` when serving one c
Same vendor: Apache Software Foundation
-
CVE-2026-83745
Apache Thrift, Apache Thrift: WebSocket frame decoders alloc -
CVE-2026-85476
Apache Thrift: c_glib `read_all` spins when the underlying r -
CVE-2026-96289
Apache Thrift: php `--gen php:inlined` struct readers (and ` -
CVE-2026-96287
Apache Thrift: Perl `FramedTransport` reads and TLS socket w -
CVE-2026-96286
Apache Thrift: Perl servers end `serve()` when serving one c
Same weakness: CWE-407
-
CVE-2026-96287
Apache Thrift: Perl `FramedTransport` reads and TLS socket w -
CVE-2026-94658
Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-sl -
CVE-2026-104426
Zebra before 6.1.0 Quadratic Complexity DoS via Block Transp -
CVE-2026-103604
Quadratic-time escaping when converting X.509 distinguished -
CVE-2026-104182
stream-json: JSONC parser and verifier re-scan the whole acc
V. Comments for CVE-2026-94653
No comments yet