CVE-2026-85494: Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.3%
Down from 0.5% on .
EPSS score, percentile 23.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 8.7 High
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- before 0.25.0
- before 0.25.0
- before 0.25.0
- before 0.25.0
- before 0.25.0
- before 0.25.0
and 3 more in the table below
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 0.25.0 |
Versions not listed are: unaffected.
Source: CVE List, as of . About the data.
About this vulnerability
Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgr…
Summary: CVE record, as of .
- CISA has not added CVE-2026-85494 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 2 Oct 2026.
- The CVE record carries a CVSS v4.0 base score of 8.7 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.3% (percentile 23.9), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact partial.
- The credits in the CVE record name Anthropic (Claude) as finder.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)
Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Source: CVE List, as of . About the data.
Weakness
CWE-130, CWE-248, CWE-407, CWE-789, CWE-1188
- CWE-130: Improper handling of length parameter inconsistency
- CWE-248: Uncaught exception
- CWE-407: Inefficient Algorithmic Complexity
- CWE-789: Memory allocation with excessive size value
- CWE-1188: Initialization of a resource with an insecure default
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
Known exploited Apache vulnerabilities
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability