Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-94652 Overview
CVE-2026-94652 is a memory leak vulnerability in the Apache Thrift C++ bindings. The flaw stems from missing release of memory after its effective lifetime, classified under [CWE-401]. All versions of Apache Thrift prior to 0.25.0 are affected. The project maintainers released version 0.25.0 to address the issue.
Attackers can trigger the condition remotely across a network without authentication or user interaction. Repeated exploitation gradually exhausts available memory in services that embed the Thrift C++ bindings, resulting in degraded availability.
Critical Impact
Remote, unauthenticated attackers can cause progressive memory exhaustion in long-running Apache Thrift C++ services, leading to a denial-of-service condition.
Affected Products
- Apache Thrift C++ bindings versions before 0.25.0
- Applications and services linking the vulnerable Thrift C++ library
- Downstream distributions packaging Thrift releases prior to 0.25.0
Discovery Timeline
- 2026-10-02 - CVE-2026-94652 published to the National Vulnerability Database
- 2026-10-05 - Last updated in NVD database
Technical Details for CVE-2026-94652
Vulnerability Analysis
The vulnerability resides in the Apache Thrift C++ bindings, which implement the Thrift serialization and remote procedure call (RPC) protocol for C++ applications. The code allocates memory during request processing but fails to free that memory once the allocation's effective lifetime ends.
Each malformed or specially crafted request leaves residual memory allocations in the server process. Over time, these orphaned allocations accumulate and consume all available heap space. Services built on Thrift C++ typically run as long-lived daemons, which makes the leak cumulative across the process lifetime.
The maintainers categorized the defect as [CWE-401] Missing Release of Memory After Effective Lifetime. The fix is included in Apache Thrift 0.25.0.
Root Cause
The root cause is an omitted deallocation path in the C++ binding code. Memory allocated during object or buffer handling is not released when the associated scope or operation completes. Because C++ requires explicit lifetime management for heap-allocated resources, missing delete, free, or smart-pointer ownership transfers directly produce a leak.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker who can reach a Thrift C++ endpoint can issue repeated requests that trigger the leaking code path. Sustained traffic causes the target process to grow its resident memory until the operating system kills it or the host runs out of memory, interrupting service availability.
No public proof-of-concept exploit has been released. Technical discussion is available on the Apache Mailing List Discussion and the Apache Mailing List Thread.
Detection Methods for CVE-2026-94652
Indicators of Compromise
- Steadily increasing resident set size (RSS) in processes linking the Thrift C++ library without a corresponding increase in legitimate workload.
- Repeated out-of-memory (OOM) kills of Thrift-based services recorded in dmesg or systemd journal entries.
- Unusual volume of Thrift RPC requests originating from a limited set of source IP addresses.
Detection Strategies
- Enumerate deployed Thrift C++ library versions across production inventory and flag any instance below 0.25.0.
- Run heap profiling tools such as valgrind --leak-check=full or jemalloc statistics against test instances to confirm the leak signature.
- Correlate process memory growth with inbound Thrift RPC traffic patterns in telemetry pipelines.
Monitoring Recommendations
- Alert on sustained memory growth of Thrift server processes over rolling 24-hour windows.
- Capture network flow data for Thrift listener ports and alert on sudden spikes in request rate from single sources.
- Track service restart counts for Thrift-based daemons and investigate repeated restarts tied to OOM events.
How to Mitigate CVE-2026-94652
Immediate Actions Required
- Inventory all applications that statically or dynamically link the Apache Thrift C++ bindings.
- Upgrade affected components to Apache Thrift 0.25.0 or later and redeploy the services.
- Restrict network exposure of Thrift endpoints to trusted clients using firewall or service mesh policies.
Patch Information
Apache Thrift version 0.25.0 contains the fix for CVE-2026-94652. Users are recommended to upgrade to this version. Refer to the Apache Mailing List Discussion for the maintainers' advisory.
Workarounds
- Place Thrift C++ services behind a rate-limiting proxy to slow the accumulation of leaked allocations.
- Configure process supervisors such as systemd to enforce memory limits and automatically restart Thrift daemons before OOM termination.
- Terminate inbound connections from sources exhibiting abnormal request volume at the network edge.
# Example systemd memory limit for a Thrift-based service
[Service]
MemoryMax=2G
MemoryHigh=1500M
Restart=on-failure
RestartSec=5s
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
