{"id":"CVE-2026-94651","published":"2026-10-02T11:17:38.890","lastModified":"2026-10-07T23:17:01.330","description":"improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-755","CWE-772"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","tags":[]},{"url":"https://lists.apache.org/thread/rflzpdvtk8yhpzg99wkf5yf277nn7267","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability occurs when Apache Thrift's Java bindings fail to properly release resources after handling exceptional conditions, leading to resource leaks that can accumulate over time and eventually cause system instability or denial of service. The flaw is particularly concerning because it can lead to uncontrolled resource consumption without any explicit error reporting.","exploitability":"Exploitation is moderately difficult as it requires triggering exceptional conditions in the Thrift bindings while maintaining a long-running process, but no specific preconditions beyond using vulnerable versions are mentioned.","blast_radius":"If exploited, this vulnerability could cause significant resource exhaustion across affected systems, potentially leading to widespread denial of service for applications relying on Apache Thrift communication.","remediation":"Upgrade to Apache Thrift version 0.25.0 which fixes the resource leak issue in the Java bindings.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["resource-leak","denial-of-service","java"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:04:08.781Z"}}