CVE-2026-94656
Description
A flaw was found in the Apache Thrift Ruby bindings. The software does not properly restrict or throttle system resource allocation during request processing. A remote attacker could exploit this vulnerability by sending crafted requests that cause excessive resource consumption, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as having Important impact for Red Hat environments because unauthenticated remote attackers can trigger complete denial of service across the network without user interaction by consuming excessive server memory. While typical Thrift deployments rely on binary or compact serialization formats, applications exposing Thrift services that utilize Ruby bindings configured with JSON protocols (TJsonProtocol or TJSONProtocol) lack upper bounds on string sizes during payload parsing. Consequently, processing maliciously oversized JSON strings can lead to process termination via out-of-memory exhaustion, though confidentiality and system integrity remain unaffected.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
