CVE-2026-94652 - Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back

MEDIUM

Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back

Published Oct 2, 2026

6.3

MEDIUM

CVSS 4.0

EPSS 0.43%

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Vendor Apache Software Foundation Product Apache Thrift Default
unaffected
Affected
- ≥ 0, < 0.25.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Apache Software Foundation	Apache Thrift	unaffected	Affected ≥ 0, < 0.25.0

No remediation recorded yet.

Weaknesses (1)

CWE-401

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91565		Advisory
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1		vendor-advisory
https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727		vendor-advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apache

Published Oct 2, 2026

Updated Oct 5, 2026

Reserved Sep 21, 2026

CISA Vulnrichment

Updated Oct 5, 2026

NVD

Status Deferred

Modified Oct 5, 2026

Red Hat

No data

ENISA EUVD

Assigner apache

Published Oct 2, 2026

Updated Oct 5, 2026

GitHub

No data