{"schemaVersion":3,"id":"CVE-2026-94633","aliases":["UBUNTU-CVE-2026-94633","DEBIAN-CVE-2026-94633"],"status":"published","duplicateOf":null,"title":null,"description":"Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.","dates":{"published":"2026-10-02T10:13:00.027Z","modified":"2026-10-02T11:28:58.258Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.7,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00426,"percentile":0.35383,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-03T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00426,"percentile":0.35383}],"last30":[{"date":"2026-10-03T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00426,"percentile":0.35383}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-130","name":"Improper Handling of Length Parameter Inconsistency","description":"The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/130.html"},{"id":"CWE-789","name":"Memory Allocation with Excessive Size Value","description":"The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/789.html"}],"affected":[{"vendor":"apache software foundation","product":"apache thrift","name":"Apache Thrift","label":"apache thrift","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.25.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.25.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_thrift"},{"vendor":"debian","product":"thrift","name":"thrift","label":"thrift","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/thrift","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"thrift","name":"thrift","label":"thrift","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thrift","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","label":"lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","hostname":"lists.apache.org","tags":["Vendor Advisory","REPORT"]},{"url":"https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k","label":"lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k","hostname":"lists.apache.org","tags":["Vendor Advisory","REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-94633","label":"ubuntu.com/security/CVE-2026-94633","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94633","label":"www.cve.org/CVERecord?id=CVE-2026-94633","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94633","label":"security-tracker.debian.org/tracker/CVE-2026-94633","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:12051-1","RHSA-2026:74369"],"duplicates":[],"related":["OPENSUSE-SU-2026:12051-1"]},"timeline":[{"kind":"published","date":"2026-10-02T10:13:00.027Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-02T11:28:58.258Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T09:35:43.331Z","stale":false,"partial":false}}