CVE-2026-94652: Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
Apache Thrift: C++ TEvhttpServer leaks its RequestContext when the processor throws before calling back
Other sources
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thrift C++ bindingsto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift C++ bindings versions before 0.25.0 are affected. The issue specifically involves the C++ TEvhttpServer RequestContext lifecycle.
What condition triggers the memory leak?
The leak occurs when the processor throws an exception before calling back. In that path, the RequestContext is not released after its effective lifetime.
What is the recommended remediation?
Upgrade Apache Thrift to version 0.25.0, which fixes the issue.