CVE-2026-94633: Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
Apache Thrift: Dart TBinaryProtocol.readMessageBegin allocates from the pre-versioned name length
Other sources
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thrift Dart bindingsto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift Dart bindings before version 0.25.0 are affected. The provided information does not identify other language bindings as affected.
What is the recommended remediation?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue.