CVE-2026-94633: Apache Thrift Dart Buffer Overflow Vulnerability

CVE-2026-94633 Overview

CVE-2026-94633 is a memory allocation vulnerability in the Apache Thrift Dart language bindings. The flaw stems from improper handling of length parameter inconsistency, allowing an attacker to trigger allocation with an excessive size value [CWE-130]. Applications using Thrift Dart bindings to deserialize untrusted input can be forced into resource exhaustion, resulting in denial of service against the target process.

Apache Thrift is a widely deployed cross-language RPC framework. The vulnerability affects all versions of Apache Thrift prior to 0.25.0. The maintainers released 0.25.0 as the fixed version.

Critical Impact
Remote, unauthenticated attackers can send crafted Thrift messages that cause memory over-allocation in Dart clients and servers, leading to availability loss.

Affected Products

Apache Thrift Dart bindings — all versions before 0.25.0
Dart applications and services consuming Thrift-serialized data over the network
RPC endpoints and clients built on vulnerable Apache Thrift Dart libraries

Discovery Timeline

2026-10-02 - CVE-2026-94633 published to the National Vulnerability Database
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-94633

Vulnerability Analysis

The vulnerability resides in the Apache Thrift Dart binding deserialization path. When parsing framed Thrift messages, the code reads a length prefix from the input stream and uses it to allocate memory for the subsequent payload. The implementation does not validate the declared length against the actual remaining bytes on the wire or against a reasonable upper bound.

An attacker who can send a Thrift message to a vulnerable endpoint supplies a length field describing a very large collection, string, or binary field. The Dart binding then attempts to allocate a buffer sized to the attacker-controlled value. The resulting allocation exhausts available process memory and terminates the service.

The weakness maps to CWE-130: Improper Handling of Length Parameter Inconsistency. Impact is restricted to availability; the issue does not grant code execution or disclose data.

Root Cause

The Thrift Dart bindings trust the length prefix in incoming messages without cross-checking it against the actual payload size or applying a configurable ceiling. This pattern is common in binary RPC protocols when deserializers pre-size containers for performance. Without a sanity check, a four-byte header controls an arbitrarily large allocation.

Attack Vector

Exploitation requires network access to a service that deserializes Thrift messages using the vulnerable Dart bindings. No authentication or user interaction is needed. An attacker crafts a Thrift binary or compact protocol frame declaring an oversized list, map, set, string, or binary field, then transmits it to the target. The parser calls into the Dart allocator with the attacker-supplied size and the process either throws an out-of-memory error or is killed by the operating system.

No verified public proof-of-concept is available at this time. Technical details are tracked in the Apache Mailing List Discussion and the Apache Mailing List Update.

Detection Methods for CVE-2026-94633

Indicators of Compromise

Dart service processes terminating with out-of-memory errors shortly after receiving external RPC traffic
Sudden spikes in resident set size (RSS) on hosts running Thrift Dart servers without a corresponding increase in legitimate request volume
Repeated short-lived TCP connections to Thrift listener ports from a small set of source addresses preceding a crash

Detection Strategies

Inspect Thrift traffic for frames whose declared container, string, or binary lengths exceed the realistic size expected by the application
Correlate process restarts of Dart-based services with inbound network flows on Thrift RPC ports
Audit dependency manifests (pubspec.yaml, pubspec.lock) to enumerate services pulling Apache Thrift Dart packages below 0.25.0

Monitoring Recommendations

Enable per-process memory ceilings and alert when Dart Thrift workers approach configured limits
Log and alert on malformed or oversized Thrift frames at ingress proxies and service meshes
Track EPSS and vendor advisories for updates; current EPSS probability is 0.426%

How to Mitigate CVE-2026-94633

Immediate Actions Required

Upgrade Apache Thrift Dart bindings to version 0.25.0 or later across all Dart services and clients
Inventory all Dart applications that import Thrift packages and prioritize internet-exposed RPC endpoints for patching
Place vulnerable services behind a reverse proxy or API gateway that enforces maximum request body sizes until patching is complete

Patch Information

Apache Thrift 0.25.0 fixes the length validation logic in the Dart bindings. Users should update the Thrift dependency in pubspec.yaml, run dart pub upgrade, and redeploy. Refer to the Apache Mailing List Update for release details.

Workarounds

Restrict network reachability of Thrift endpoints to trusted clients using firewall rules or mutual TLS
Enforce request size limits at a load balancer or ingress controller to bound maximum payload bytes per connection
Deploy process-level memory limits (for example, container memory limits or systemdMemoryMax) so an oversized allocation fails fast without exhausting host resources

bash

# Configuration example
# Update Thrift Dart dependency to the fixed release
dart pub add thrift:^0.25.0
dart pub upgrade thrift