CVE-2026-94654
Description
A flaw was found in Apache Thrift's Python bindings. A remote attacker could trigger an infinite loop during data processing, leading to a Denial of Service (DoS). By sending specially crafted input, an attacker can cause the application to hang and consume excessive resources, making the service unavailable to legitimate users.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can exploit it to cause complete process lockup and service unavailability without requiring privileges. In Red Hat environments, Apache Thrift is not typically deployed as an exposed standalone service by default, but custom or integrated applications utilizing these Python bindings to parse untrusted network payloads remain vulnerable. Because an infinite parsing loop directly monopolizes CPU resources and starves legitimate operations, affected worker processes must be manually restarted to restore normal functionality.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
