CVE-2026-94636
No fix known EPSS <1%CVSS 8.2
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Products: Apache Software Foundation Apache Thrift
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | thrift | no fix |
| Debian 13 | thrift | no fix |
| Debian 14 | thrift | no fix |
| Ubuntu 16.04 LTS | python-thrift | no fix |
| Ubuntu 18.04 LTS | python-thrift | no fix |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | thrift | no fix |