CVE-2026-94653
Description
A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this issue to cause a Denial of Service (DoS) by sending specially crafted input. Due to inefficient algorithmic processing, handling these requests consumes disproportionate computing resources, causing the application to become unresponsive.
Statement
This vulnerability is rated as Important because an unauthenticated remote actor can induce excessive CPU consumption and trigger a denial of service without needing prior privileges. In Red Hat environments, exposure is limited to deployments serving endpoints implemented with Apache Thrift PHP bindings using framed, memory, or HTTP transport layers. Applications that do not expose PHP-based Thrift services to untrusted networks or that do not utilize the PHP transport bindings are not affected by this flaw.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
