CVE-2026-94656: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound
Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thrift ruby bindingsto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Thrift Ruby bindings are affected when using versions before 0.25.0. The issue is specifically associated with the rb TJsonProtocol/TJSONProtocol implementation.
What is required for exploitation?
An attacker would need to cause the affected Ruby JSON protocol implementation to process string data. Because string size is not bounded, processing can allocate resources without limits or throttling.
What should teams do if they cannot patch immediately?
The provided information recommends upgrading to Apache Thrift 0.25.0. No alternative mitigation or configuration workaround is specified.